An update for ImageMagick is now available for openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3851 Final 1.0 1.0 2026-09-14 Initial 2026-09-14 2026-09-14 openEuler SA Tool V1.0 2026-09-14 ImageMagick security update An update for ImageMagick is now available for openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4 Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves. Security Fix(es): ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.(CVE-2026-86420) ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.(CVE-2026-86421) ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).(CVE-2026-86423) ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.(CVE-2026-86424) ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service).(CVE-2026-86425) An update for ImageMagick is now available for openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium ImageMagick https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86420 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86421 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86423 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86424 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-86425 https://nvd.nist.gov/vuln/detail/CVE-2026-86420 https://nvd.nist.gov/vuln/detail/CVE-2026-86421 https://nvd.nist.gov/vuln/detail/CVE-2026-86423 https://nvd.nist.gov/vuln/detail/CVE-2026-86424 https://nvd.nist.gov/vuln/detail/CVE-2026-86425 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 ImageMagick-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-c++-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-devel-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-perl-7.1.2.31-1.oe2403sp1.aarch64.rpm ImageMagick-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-c++-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-devel-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-perl-7.1.2.31-1.oe2403sp3.aarch64.rpm ImageMagick-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-c++-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-devel-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-perl-7.1.2.31-1.oe2403sp4.aarch64.rpm ImageMagick-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-c++-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-c++-devel-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-debuginfo-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-debugsource-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-devel-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-perl-6.9.13.56-1.oe2003sp4.aarch64.rpm ImageMagick-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-c++-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-devel-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-perl-7.1.2.31-1.oe2203sp4.aarch64.rpm ImageMagick-7.1.2.31-1.oe2403sp1.src.rpm ImageMagick-7.1.2.31-1.oe2403sp3.src.rpm ImageMagick-7.1.2.31-1.oe2403sp4.src.rpm ImageMagick-6.9.13.56-1.oe2003sp4.src.rpm ImageMagick-7.1.2.31-1.oe2203sp4.src.rpm ImageMagick-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-c++-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-devel-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-perl-7.1.2.31-1.oe2403sp1.x86_64.rpm ImageMagick-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-c++-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-devel-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-perl-7.1.2.31-1.oe2403sp3.x86_64.rpm ImageMagick-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-c++-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-devel-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-perl-7.1.2.31-1.oe2403sp4.x86_64.rpm ImageMagick-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-c++-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-c++-devel-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-debuginfo-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-debugsource-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-devel-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-perl-6.9.13.56-1.oe2003sp4.x86_64.rpm ImageMagick-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-c++-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-c++-devel-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-debuginfo-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-debugsource-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-devel-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-perl-7.1.2.31-1.oe2203sp4.x86_64.rpm ImageMagick-help-7.1.2.31-1.oe2403sp1.noarch.rpm ImageMagick-help-7.1.2.31-1.oe2403sp3.noarch.rpm ImageMagick-help-7.1.2.31-1.oe2403sp4.noarch.rpm ImageMagick-help-6.9.13.56-1.oe2003sp4.noarch.rpm ImageMagick-help-7.1.2.31-1.oe2203sp4.noarch.rpm ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. 2026-09-14 CVE-2026-86420 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Medium 6.3 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ImageMagick security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851 ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. 2026-09-14 CVE-2026-86421 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Medium 6.3 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X ImageMagick security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851 ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service). 2026-09-14 CVE-2026-86423 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Low 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L ImageMagick security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851 ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations. 2026-09-14 CVE-2026-86424 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Low 2.5 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N ImageMagick security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851 ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial of service). 2026-09-14 CVE-2026-86425 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 Low 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L ImageMagick security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3851