Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
ImageMagick can leak memory and crash
published 3 months ago
Summary
The ImageMagick packages for CentOS Stream (including the C++ libraries and development files) contain code that could waste memory or cause a crash when processing certain image loops. This can affect any system that uses these tools to handle images. Updating to the latest ImageMagick 6.9.13.50 release from the official repositories resolves the issue.
What to do
- Update centos-stream imagemagick to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-c++ to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-c++-devel to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-devel to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-djvu to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-doc to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-libs to version 6.9.13.50-1.el8.tuxcare.els1.
- Update centos-stream imagemagick-perl to version 6.9.13.50-1.el8.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-c++ |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-c++-devel |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-devel |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-djvu |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-doc |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-libs |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
| TuxCare:CentOS-Stream:8 | centos-stream | imagemagick-perl |
< 6.9.13.50-1.el8.tuxcare.els1 Fix: upgrade to 6.9.13.50-1.el8.tuxcare.els1
|
Original advisory text
ImageMagick: Fix of 17 CVEs
- Rebase to upstream 6.9.13.50, matching EPEL 8 ImageMagick-6.9.13.50-1.el8
- Drop the TuxCare CVE patches whose fixes are included in the upstream
6.9.13.50 release
- Keep the MSL empty-image crash fix (partial backport of upstream
fde1f305, not present in the legacy 6.x line)
- CVE-2026-45664: free the chunk buffer on the MNG LOOP/ENDL op-cap abort
path (upstream dd198f960, not yet included in 6.9.13.50) to prevent a
heap memory leak when the loop-operation limit is hit
- Drop the TuxCare CVE patches whose fixes are included in the upstream
6.9.13.50 release
- Keep the MSL empty-image crash fix (partial backport of upstream
fde1f305, not present in the legacy 6.x line)
- CVE-2026-45664: free the chunk buffer on the MNG LOOP/ENDL op-cap abort
path (upstream dd198f960, not yet included in 6.9.13.50) to prevent a
heap memory leak when the loop-operation limit is hit
References
- https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1784536823.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42326 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45031 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45359 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45624 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45664 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46520 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46521 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46522 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46523 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48733 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48734 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-48994 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56361 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56367 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56368 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56370 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56378 Vendor Advisory
Timeline
Published20 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784536823 · OSV
Track software like this
Free during beta