ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled bytes below the heap buffer, causing crashes or code execution.

The remote host has a version of ImageMagick installed that is prior to 6.9.13-58, or 7.x prior to 7.1.2-33. It is, therefore, affected by a heap buffer underwrite vulnerability:

  - ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in     coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file     with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128 controlled     bytes below the heap buffer, causing crashes or code execution. (CVE-2026-109964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. The detections used by this plugin do not determine the architecture of the installed build, so the plugin reports only when the scan is configured to show potential false alarms.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:5095-1 advisory.

    This update for GraphicsMagick fixes the following issue:

    - CVE-2026-109964: heap buffer overwrite in PICT decoder on 32-bit systems (bsc#1285423).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793719329 advisory.

  - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values     returned when reading image properties. Attackers can repeatedly trigger property reads through five     affected PerlMagick code locations to exhaust memory and cause denial of service. (CVE-2026-116157)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the     handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to     overwrite stack memory during decoding, causing crashes or memory corruption. (CVE-2026-116149)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does     not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG     encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
    (CVE-2026-109260)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which     fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that     triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a     denial of service. (CVE-2026-109263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793719568 advisory.

  - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values     returned when reading image properties. Attackers can repeatedly trigger property reads through five     affected PerlMagick code locations to exhaust memory and cause denial of service. (CVE-2026-116157)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the     handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to     overwrite stack memory during decoding, causing crashes or memory corruption. (CVE-2026-116149)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does     not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG     encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
    (CVE-2026-109260)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which     fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that     triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a     denial of service. (CVE-2026-109263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793719568 advisory.

  - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values     returned when reading image properties. Attackers can repeatedly trigger property reads through five     affected PerlMagick code locations to exhaust memory and cause denial of service. (CVE-2026-116157)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the     handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to     overwrite stack memory during decoding, causing crashes or memory corruption. (CVE-2026-116149)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does     not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG     encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.
    (CVE-2026-109260)

  - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which     fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that     triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a     denial of service. (CVE-2026-109263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4875 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4875-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     October 31, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : imagemagick     Version        : 8:6.9.11.60+dfsg-1.6+deb12u15     CVE ID         : CVE-2026-105081 CVE-2026-105083 CVE-2026-109259 CVE-2026-109260                      CVE-2026-109262 CVE-2026-109263 CVE-2026-109264 CVE-2026-109266                      CVE-2026-109267 CVE-2026-109268 CVE-2026-109269 CVE-2026-109273                      CVE-2026-109275 CVE-2026-109276 CVE-2026-109278 CVE-2026-109279                      CVE-2026-109964 CVE-2026-116140 CVE-2026-116143 CVE-2026-116144                      CVE-2026-116145 CVE-2026-116146 CVE-2026-116147 CVE-2026-116148                      CVE-2026-116149 CVE-2026-116150 CVE-2026-116151 CVE-2026-116154                      CVE-2026-116155 CVE-2026-116157 CVE-2026-116159 CVE-2026-116160     Debian Bug     : 1150802

    Multiple security vulnerabilities were discovered in imagemagick, a     software suite used for editing and manipulating digital images, which     could lead to denial of service, information disclosure or potentially     arbitrary code execution if malformed images are processed.

    For Debian 12 bookworm, these problems have been fixed in version     8:6.9.11.60+dfsg-1.6+deb12u15.

    We recommend that you upgrade your imagemagick packages.

    For the detailed security status of imagemagick please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/imagemagick

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fc4d0a5b-d0c6-11f1-bae2-3497f65b111b advisory.

    The ImageMagick project published security advisories for               issues fixed in releases 7.1.2-26 through 7.1.2-34.  They include               heap buffer overflows, use-after-free, out-of-bounds reads,               integer overflows, division by zero, memory leaks and security               policy bypasses in various coders and in the command-line               interface.  A crafted image file can crash the process, disclose               memory contents or circumvent the configured security policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fc4d429d-d0c6-11f1-bae2-3497f65b111b advisory.

    The ImageMagick project published security advisories for               issues fixed in releases 6.9.13-51 through 6.9.13-59.  They include               heap buffer overflows, use-after-free, out-of-bounds reads,               integer overflows, division by zero, memory leaks and security               policy bypasses in various coders.  A crafted image file can               crash the process, disclose memory contents or circumvent the               configured security policy.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792717651 advisory.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on     32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106567)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter     an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32     and 6.9.13-57. (CVE-2026-106568)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer     calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in     versions 6.9.13-56 and 7.1.2-31. (CVE-2026-106571)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to     exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
    (CVE-2026-106572)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript     coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56. (CVE-2026-106577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage()     in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT     file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128     controlled bytes below the heap buffer, causing crashes or code execution. (CVE-2026-109964)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage()
    in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT
    file with maximized row, column and bytes-per-line values to bypass bounds checks and write up to 128
    controlled bytes below the heap buffer, causing crashes or code execution. (CVE-2026-109964)

ID	Name	Product	Family	Type	Severity
378781	ImageMagick < 6.9.13-58 / 7.x < 7.1.2-33 Heap Buffer Underwrite (CVE-2026-109964)	Nessus	Misc.	Local	medium
376267	SUSE SLES15: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (SUSE-SU-2026:5095-1)	Nessus	SuSE Local Security Checks	Local	medium
375531	AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793719329)	Nessus	Alma Linux Local Security Checks	Local	high
375525	AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793719568)	Nessus	Alma Linux Local Security Checks	Local	high
375521	Rocky Linux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793719568)	Nessus	Rocky Linux Local Security Checks	Local	high
374703	Debian dla-4875 : imagemagick - security update	Nessus	Debian Local Security Checks	Local	high
372203	FreeBSD : ImageMagick7 -- multiple vulnerabilities (fc4d0a5b-d0c6-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
372202	FreeBSD : ImageMagick6 -- multiple vulnerabilities (fc4d429d-d0c6-11f1-bae2-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
372117	CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792717651)	Nessus	CentOS Local Security Checks	Local	critical
369388	Linux Distros Unpatched Vulnerability : CVE-2026-109964	Nessus	Misc.	Local	medium
474809	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474809	Echo: imagemagick: security update to 8:7.1.2.33+dfsg1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-109964

medium

Tenable Plugins

medium

medium

high

high

high

high

high

high

critical

medium

medium

medium