Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
ImageMagick on CentOS can crash or expose data
published 8 months ago
Summary
Several parts of ImageMagick packages for CentOS (including the C++ libraries and development files) contain coding errors that could cause the program to stop working, reveal internal information, or get stuck in a loop. An attacker who can supply specially crafted image files might trigger these conditions. Update the ImageMagick packages to the latest versions provided by CentOS to apply the fixes.
What to do
- Update centos imagemagick to version 6.9.10.68-7.0.3.el7_9.tuxcare.els5.
- Update centos imagemagick-c++ to version 6.9.10.68-7.0.3.el7_9.tuxcare.els5.
- Update centos imagemagick-c++-devel to version 6.9.10.68-7.0.3.el7_9.tuxcare.els5.
- Update centos imagemagick-devel to version 6.9.10.68-7.0.3.el7_9.tuxcare.els5.
- Update centos imagemagick-doc to version 6.9.10.68-7.0.3.el7_9.tuxcare.els5.
- Update centos imagemagick-perl to version 6.9.10.68-7.0.3.el7_9.tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | imagemagick |
< 6.9.10.68-7.0.3.el7_9.tuxcare.els5 Fix: upgrade to 6.9.10.68-7.0.3.el7_9.tuxcare.els5
|
| TuxCare:CentOS:7 | centos | imagemagick-c++ |
< 6.9.10.68-7.0.3.el7_9.tuxcare.els5 Fix: upgrade to 6.9.10.68-7.0.3.el7_9.tuxcare.els5
|
| TuxCare:CentOS:7 | centos | imagemagick-c++-devel |
< 6.9.10.68-7.0.3.el7_9.tuxcare.els5 Fix: upgrade to 6.9.10.68-7.0.3.el7_9.tuxcare.els5
|
| TuxCare:CentOS:7 | centos | imagemagick-devel |
< 6.9.10.68-7.0.3.el7_9.tuxcare.els5 Fix: upgrade to 6.9.10.68-7.0.3.el7_9.tuxcare.els5
|
| TuxCare:CentOS:7 | centos | imagemagick-doc |
< 6.9.10.68-7.0.3.el7_9.tuxcare.els5 Fix: upgrade to 6.9.10.68-7.0.3.el7_9.tuxcare.els5
|
| TuxCare:CentOS:7 | centos | imagemagick-perl |
< 6.9.10.68-7.0.3.el7_9.tuxcare.els5 Fix: upgrade to 6.9.10.68-7.0.3.el7_9.tuxcare.els5
|
Original advisory text
ImageMagick: Fix of 9 CVEs
- CVE-2026-25798: fix NULL pointer dereference in ClonePixelCacheRepository
- CVE-2026-24481: fix heap information disclosure in PSD handler
- CVE-2026-25799: fix division-by-zero in YUV sampling factor validation
- CVE-2026-26284: fix out-of-bounds read in PCD Huffman decoder
- CVE-2026-25897: fix integer overflow in Sun decoder on 32-bit systems
- CVE-2026-26066: fix infinite loop in IPTCTEXT profile writing
- CVE-2026-26283: fix infinite loop in JPEG encoder extent binary search
- CVE-2026-25795: fix NULL pointer dereference in ReadSFWImage
- CVE-2026-25796: fix memory leak in ReadSTEGANOImage
- CVE-2026-24481: fix heap information disclosure in PSD handler
- CVE-2026-25799: fix division-by-zero in YUV sampling factor validation
- CVE-2026-26284: fix out-of-bounds read in PCD Huffman decoder
- CVE-2026-25897: fix integer overflow in Sun decoder on 32-bit systems
- CVE-2026-26066: fix infinite loop in IPTCTEXT profile writing
- CVE-2026-26283: fix infinite loop in JPEG encoder extent binary search
- CVE-2026-25795: fix NULL pointer dereference in ReadSFWImage
- CVE-2026-25796: fix memory leak in ReadSTEGANOImage
References
Timeline
Published4 Mar 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2026-1772452097 · OSV
Track software like this
Free during beta