Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
ImageMagick may let attackers corrupt memory or hijack files
published 4 months ago
Summary
The ImageMagick distributed pixel cache server and JP2 image encoder contain flaws that could allow a remote user to overwrite memory, read unintended data, or hijack file descriptors. This could lead to unauthorized access or service disruption. Apply the latest security updates for ImageMagick from your distribution to protect your systems.
What to do
- Update canonical imagemagick to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical imagemagick-6-common to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical imagemagick-6-doc to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical imagemagick-6.q16 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical imagemagick-6.q16hdri to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical imagemagick-common to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical imagemagick-doc to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libimage-magick-perl to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libimage-magick-q16-perl to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libimage-magick-q16hdri-perl to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagick++-6-headers to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagick++-6.q16-7 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagick++-6.q16-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagick++-6.q16hdri-7 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagick++-6.q16hdri-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagick++-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6-arch-config to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6-headers to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6.q16-3 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6.q16-3-extra to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6.q16-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6.q16hdri-3 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6.q16hdri-3-extra to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-6.q16hdri-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickcore-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickwand-6-headers to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickwand-6.q16-3 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickwand-6.q16-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickwand-6.q16hdri-3 to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickwand-6.q16hdri-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical libmagickwand-dev to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
- Update canonical perlmagick to version 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick-6-common |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick-6-doc |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick-6.q16 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick-6.q16hdri |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick-common |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | imagemagick-doc |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libimage-magick-perl |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libimage-magick-q16-perl |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libimage-magick-q16hdri-perl |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagick++-6-headers |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagick++-6.q16-7 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagick++-6.q16-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagick++-6.q16hdri-7 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagick++-6.q16hdri-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagick++-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6-arch-config |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6-headers |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6.q16-3 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6.q16-3-extra |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6.q16-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6.q16hdri-3 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6.q16hdri-3-extra |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-6.q16hdri-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickcore-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickwand-6-headers |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickwand-6.q16-3 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickwand-6.q16-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickwand-6.q16hdri-3 |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickwand-6.q16hdri-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | libmagickwand-dev |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
| TuxCare:Ubuntu:18.04 | canonical | perlmagick |
< 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38 Fix: upgrade to 8:6.9.7.4+dfsg-16ubuntu6.15+tuxcare.els38
|
Original advisory text
Fix CVE(s): CVE-2026-46559, CVE-2026-46692, CVE-2026-46693, CVE-2026-47166
* SECURITY UPDATE: heap over-write, file-descriptor hijack race, and heap
over-read in the distributed pixel cache server
- debian/patches/CVE-2026-46692-46693-47166.patch: bound the requested
region against the pixel cache extent before reading or writing pixels
and indexes, and hand each connection a private heap-allocated socket to
a detached handler thread in magick/distribute-cache.c
- CVE-2026-46692
- CVE-2026-46693
- CVE-2026-47166
* SECURITY UPDATE: heap buffer over-write of a single byte in the JP2
encoder via crafted jp2:quality / jp2:rate options
- debian/patches/CVE-2026-46559.patch: bound the jp2:quality and jp2:rate
parse loops by the tcp_distoratio/tcp_rates array extent in
WriteJP2Image() in coders/jp2.c (defense-in-depth; the JP2 coder is not
compiled in this build)
- CVE-2026-46559
over-read in the distributed pixel cache server
- debian/patches/CVE-2026-46692-46693-47166.patch: bound the requested
region against the pixel cache extent before reading or writing pixels
and indexes, and hand each connection a private heap-allocated socket to
a detached handler thread in magick/distribute-cache.c
- CVE-2026-46692
- CVE-2026-46693
- CVE-2026-47166
* SECURITY UPDATE: heap buffer over-write of a single byte in the JP2
encoder via crafted jp2:quality / jp2:rate options
- debian/patches/CVE-2026-46559.patch: bound the jp2:quality and jp2:rate
parse loops by the tcp_distoratio/tcp_rates array extent in
WriteJP2Image() in coders/jp2.c (defense-in-depth; the JP2 coder is not
compiled in this build)
- CVE-2026-46559
References
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1782314022.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46559 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46692 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46693 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-47166 Vendor Advisory
Timeline
Published24 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1782314022 · OSV
Track software like this
Free during beta