Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

ImageMagick -morph can corrupt memory and crash

published today
Summary

The ImageMagick package on openEuler can overflow memory when the -morph feature processes specially crafted images. This can cause the program to become unstable or stop working. Upgrade to ImageMagick version 7.1.2-34 or later to eliminate the risk.

What to do
  • Update openeuler imagemagick to version 7.1.2.35-1.oe2403sp1.
Affected software
Ecosystem VendorProductAffected versions
openEuler:24.03-LTS-SP1 openeuler imagemagick < 7.1.2.35-1.oe2403sp1
Fix: upgrade to 7.1.2.35-1.oe2403sp1
Original advisory text
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.

Security Fix(es):

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the application.(CVE-2026-119124)
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
OESA-2026-4680 · OSV
Track software like this
Free during beta