An update for ImageMagick is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3060 Final 1.0 1.0 2026-07-19 Initial 2026-07-19 2026-07-19 openEuler SA Tool V1.0 2026-07-19 ImageMagick security update An update for ImageMagick is now available for openEuler-24.03-LTS-SP4 Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es): ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service.(CVE-2026-56372) ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.(CVE-2026-61465) ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.(CVE-2026-61857) ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.(CVE-2026-61858) ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.(CVE-2026-61861) ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.(CVE-2026-61870) An update for ImageMagick is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Low ImageMagick https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56372 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61465 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61857 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61858 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61861 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61870 https://nvd.nist.gov/vuln/detail/CVE-2026-56372 https://nvd.nist.gov/vuln/detail/CVE-2026-61465 https://nvd.nist.gov/vuln/detail/CVE-2026-61857 https://nvd.nist.gov/vuln/detail/CVE-2026-61858 https://nvd.nist.gov/vuln/detail/CVE-2026-61861 https://nvd.nist.gov/vuln/detail/CVE-2026-61870 openEuler-24.03-LTS-SP4 ImageMagick-7.1.2.27-1.oe2403sp4.src.rpm ImageMagick-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-c++-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-c++-devel-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-debuginfo-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-debugsource-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-devel-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-perl-7.1.2.27-1.oe2403sp4.x86_64.rpm ImageMagick-help-7.1.2.27-1.oe2403sp4.noarch.rpm ImageMagick-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick-c++-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick-c++-devel-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick-debuginfo-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick-debugsource-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick-devel-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick-perl-7.1.2.27-1.oe2403sp4.aarch64.rpm ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service. 2026-07-19 CVE-2026-56372 openEuler-24.03-LTS-SP4 Low 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L ImageMagick security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060 ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service. 2026-07-19 CVE-2026-61465 openEuler-24.03-LTS-SP4 Low 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L ImageMagick security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060 ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes. 2026-07-19 CVE-2026-61857 openEuler-24.03-LTS-SP4 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L ImageMagick security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060 ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process. 2026-07-19 CVE-2026-61858 openEuler-24.03-LTS-SP4 Low 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ImageMagick security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060 ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution. 2026-07-19 CVE-2026-61861 openEuler-24.03-LTS-SP4 Low 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L ImageMagick security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060 ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service. 2026-07-19 CVE-2026-61870 openEuler-24.03-LTS-SP4 Low 2.9 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L ImageMagick security update 2026-07-19 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3060