ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fc4d0a5b-d0c6-11f1-bae2-3497f65b111b advisory.

    The ImageMagick project published security advisories for               issues fixed in releases 7.1.2-26 through 7.1.2-34.  They include               heap buffer overflows, use-after-free, out-of-bounds reads,               integer overflows, division by zero, memory leaks and security               policy bypasses in various coders and in the command-line               interface.  A crafted image file can crash the process, disclose               memory contents or circumvent the configured security policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4858 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4858-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 26, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : imagemagick     Version        : 8:6.9.11.60+dfsg-1.6+deb12u14     CVE ID         : CVE-2026-25971 CVE-2026-62343 CVE-2026-62946 CVE-2026-64685                      CVE-2026-86420 CVE-2026-86421 CVE-2026-86423 CVE-2026-86424                      CVE-2026-86425 CVE-2026-93586 CVE-2026-93587 CVE-2026-93588                      CVE-2026-93589 CVE-2026-102635 CVE-2026-106565 CVE-2026-106566                      CVE-2026-106567 CVE-2026-106568 CVE-2026-106570 CVE-2026-106571                      CVE-2026-106572 CVE-2026-106573 CVE-2026-106577 CVE-2026-106578                      CVE-2026-106579 CVE-2026-106580 CVE-2026-107208 CVE-2026-107209                      CVE-2026-107210 CVE-2026-109261     Debian Bug     : 1147176 1149974 1150224 1150337

    Multiple security vulnerabilities were discovered in imagemagick, a     software suite used for editing and manipulating digital images, which     could lead to denial of service, information disclosure or potentially     arbitrary code execution if malformed images are processed.

    Also note that this release fixes a regression where converting an SVG     with an embedded PNG data URI to PNG fails.

    For Debian 12 bookworm, these problems have been fixed in version     8:6.9.11.60+dfsg-1.6+deb12u14.

    We recommend that you upgrade your imagemagick packages.

    For the detailed security status of imagemagick please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4799-1 advisory.

    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to     something       else that is valid xml (bsc#1284217).
    - CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an     infinite loop       (bsc#1284662).
    - CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable,     allowing a       local privileged workflow to overwrite a file with random data (bsc#1284663).
    - CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing     an infinite       loop and DoS (bsc#1284664).
    - CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an     infinite loop       (bsc#1284665).
    - CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed     pixel cache       server and exhaust its available connections, causing a DoS (bsc#1284667).
    - CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation     error and write       beyond a heap buffer, crashing the server process (bsc#1284668).
    - CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to     exhaust the call       stack and terminate the process (bsc#1284669).
    - CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an     excessively long-       running operation (bsc#1284671).
    - CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data     that triggers a       heap buffer overwrite and crash the server (bsc#1284672).
    - CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing     repeated       processing to exhaust available file descriptors (bsc#1284673).
    - CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript     coders       (bsc#1284675).
    - CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the     process       (bsc#1284677).
    - CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its     domain, potentially       allowing data prohibited by the policy to be read (bsc#1284678).
    - CVE-2026-106580: a missing security-policy check in the CUT encoder allows a crafted local encoding     operation to read       data that policy should deny and can also cause a crash (bsc#1284680).
    - CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition     instead of an       ordinary exception, terminating the image-processing process (bsc#1284681).
    - CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a     resource limit       can cause a crash (bsc#1284682).
    - CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files     larger than the       configured security-policy limit (bsc#1284683).
    - CVE-2026-109259: Information disclosure via crafted TGA image (bsc#1285071).
    - CVE-2026-109260: Denial of Service via memory leak in PNG encoder (bsc#1285071).
    - CVE-2026-109261: Denial of Service via memory leak in GIF encoder (bsc#1285071).
    - CVE-2026-109262: Denial of Service via memory leak in SVG encoder (bsc#1285071).
    - CVE-2026-109263: Denial of Service via memory leak in YUV encoder (bsc#1285071).
    - CVE-2026-109266: XML injection vulnerability in the CIP encoder (bsc#1285071).
    - CVE-2026-109268: Denial of Service via use-after-free in PDF writer (bsc#1285071).
    - CVE-2026-109269: Information disclosure via crafted JPEG file (bsc#1285071).
    - CVE-2026-109270: Denial of Service via memory leak in the -process option (bsc#1285071).
    - CVE-2026-109273: Information disclosure via crafted PostScript file (bsc#1285071).
    - CVE-2026-109275: Code injection via crafted MVG file (bsc#1285071).
    - CVE-2026-109276: Denial of Service via temporary file leak in JNG decoder (bsc#1285071).
    - CVE-2026-109277: Security policy bypass via -script operation (bsc#1285071).
    - CVE-2026-109278: Denial of Service via memory leak in wavelet-denoise operation (bsc#1285071).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792591590 advisory.

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the     IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed.
    Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured     policy. (CVE-2026-105081)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a     local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
    (CVE-2026-106566)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its     domain, potentially allowing data prohibited by the policy to be read. This issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-106579)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding     operation to read data that policy should deny and can also cause a crash. This issue is fixed in versions     7.1.2-31 and 6.9.13-56. (CVE-2026-106580)

  - Rejected reason: This CVE ID has been rejected as a duplicate. (CVE-2026-105403, CVE-2026-105404,     CVE-2026-105823)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4691-1 advisory.

    - CVE-2026-86420: Denial of Service due to memory budget exhaustion (bsc#1279696).
    - CVE-2026-86421: Denial of Service via memory leak in MSL decoder (bsc#1279711).
    - CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetList method (bsc#1279794).
    - CVE-2026-86425: Denial of Service due to heap-use-after-free vulnerability (bsc#1279797).
    - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912).
    - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a     denial of       service (bsc#1281909).
    - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910).
    - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911).
    - CVE-2026-93590: failure to perform policy checks during buffer allocation for image pixels in the UHDR     encoder can       lead to denial of service (bsc#1281913).
    - CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to     something       else that is valid xml (bsc#1284217).
    - CVE-2026-106564: a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing     the process to       crash (bsc#1284661).
    - CVE-2026-106565: a missing end-of-file check while reading bzip2-compressed image data can cause an     infinite loop       (bsc#1284662).
    - CVE-2026-106566: delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable,     allowing a       local privileged workflow to overwrite a file with random data (bsc#1284663).
    - CVE-2026-106567: a crafted PSD file can trigger an integer-conversion error in the PSD decoder, causing     an infinite       loop and DoS (bsc#1284664).
    - CVE-2026-106568: a crafted XMP profile embedded in an image can cause the profile parser to enter an     infinite loop       (bsc#1284665).
    - CVE-2026-106570: an unauthenticated adjacent-network client can repeatedly connect to the distributed     pixel cache       server and exhaust its available connections, causing a DoS (bsc#1284667).
    - CVE-2026-106571: a crafted local call to the GetVirtualPixels API can trigger an integer calculation     error and write       beyond a heap buffer, crashing the server process (bsc#1284668).
    - CVE-2026-106572: a missing recursion-depth check in the CALS decoder allows a crafted CALS image to     exhaust the call       stack and terminate the process (bsc#1284669).
    - CVE-2026-106573: a missing limit check in the MVG decoder allows a crafted MVG image to trigger an     excessively long-       running operation (bsc#1284671).
    - CVE-2026-106574: a client connected to the distributed pixel cache server can send crafted pixel data     that triggers a       heap buffer overwrite and crash the server (bsc#1284672).
    - CVE-2026-106575: a crafted Magick script can cause an opened file pointer to remain unclosed, allowing     repeated       processing to exhaust available file descriptors (bsc#1284673).
    - CVE-2026-106576: a crafted XMP profile can trigger excessive work while the parser determines a rational     value's       numerator and denominator, causing a DoS (bsc#1284674).
    - CVE-2026-106577: unescaped or untrimmed values can inject code into output generated by PostScript     coders       (bsc#1284675).
    - CVE-2026-106578: a crafted image can cause an invalid memory free in the MVG decoder and crash the     process       (bsc#1284677).
    - CVE-2026-106579: a crafted image can bypass an ImageMagick security policy that uses coder as its     domain, potentially       allowing data prohibited by the policy to be read (bsc#1284678).
    - CVE-2026-107208: a crafted XMP profile can reach a recursion limit that is handled as a fatal condition     instead of an       ordinary exception, terminating the image-processing process (bsc#1284681).
    - CVE-2026-107209: when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a     resource limit       can cause a crash (bsc#1284682).
    - CVE-2026-107210: a crafted highly compressed MAT image can make the MAT decoder create temporary files     larger than the       configured security-policy limit (bsc#1284683).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to
    7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a
    local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
    (CVE-2026-106566)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792145396 advisory.

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the     IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed.
    Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured     policy. (CVE-2026-105081)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an     infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
    (CVE-2026-106565)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a     local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
    (CVE-2026-106566)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer     calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in     versions 6.9.13-56 and 7.1.2-31. (CVE-2026-106571)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792145295 advisory.

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the     IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed.
    Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured     policy. (CVE-2026-105081)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an     infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
    (CVE-2026-106565)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a     local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
    (CVE-2026-106566)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer     calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in     versions 6.9.13-56 and 7.1.2-31. (CVE-2026-106571)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792144313 advisory.

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the     IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed.
    Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured     policy. (CVE-2026-105081)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an     infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.
    (CVE-2026-106565)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a     local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
    (CVE-2026-106566)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer     calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in     versions 6.9.13-56 and 7.1.2-31. (CVE-2026-106571)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a     local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
    (CVE-2026-106566)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372203	FreeBSD : ImageMagick7 -- multiple vulnerabilities (fc4d0a5b-d0c6-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
371989	Debian dla-4858 : imagemagick - security update	Nessus	Debian Local Security Checks	Local	medium
370400	SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4799-1)	Nessus	SuSE Local Security Checks	Local	medium
370235	CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792591590)	Nessus	CentOS Local Security Checks	Local	low
366747	SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4691-1)	Nessus	SuSE Local Security Checks	Local	medium
474797	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474797	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
366525	CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792145396)	Nessus	CentOS Local Security Checks	Local	medium
366517	CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792145295)	Nessus	CentOS Local Security Checks	Local	medium
366516	CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792144313)	Nessus	CentOS Local Security Checks	Local	medium
363897	Linux Distros Unpatched Vulnerability : CVE-2026-106566	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-106566

medium

Tenable Plugins

high

medium

medium

low

medium

medium

medium

medium

medium

medium

medium