ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF
    writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that,
    when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the
    process. (CVE-2026-109268)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792145396 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA     image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to     disclose contents of uninitialized memory from the ImageMagick process. (CVE-2026-109259)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which     fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that     triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a     denial of service. (CVE-2026-109263)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF     writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that,     when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the     process. (CVE-2026-109268)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG     decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded,     injects code into the PostScript rendering path. (CVE-2026-109275)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792145295 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA     image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to     disclose contents of uninitialized memory from the ImageMagick process. (CVE-2026-109259)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which     fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that     triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a     denial of service. (CVE-2026-109263)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF     writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that,     when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the     process. (CVE-2026-109268)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG     decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded,     injects code into the PostScript rendering path. (CVE-2026-109275)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792144313 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA     image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to     disclose contents of uninitialized memory from the ImageMagick process. (CVE-2026-109259)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which     fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that     triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a     denial of service. (CVE-2026-109263)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF     writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that,     when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the     process. (CVE-2026-109268)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG     decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded,     injects code into the PostScript rendering path. (CVE-2026-109275)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
474765	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474765	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
366525	CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792145396)	Nessus	CentOS Local Security Checks	Local	medium
366517	CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792145295)	Nessus	CentOS Local Security Checks	Local	medium
366516	CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792144313)	Nessus	CentOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-109268

medium

Tenable Plugins

medium

medium

medium

medium

medium