ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed in versions 6.9.13-52 and 7.1.2-27.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8739-1 advisory.

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu     18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56366, CVE-2026-56368, CVE-2026-56371,     CVE-2026-56373)

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS     and Ubuntu 26.04 LTS. (CVE-2026-56370)

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service or expose sensitive information. This issue only affected Ubuntu 14.04     LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56378)

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-56379)

    It was discovered that ImageMagick incorrectly handled memory allocation in certain operations. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04     LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61465)

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS.
    (CVE-2026-61857)

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. (CVE-2026-61863, CVE-2026-61864, CVE-2026-61865, CVE-2026-61870)

    It was discovered that ImageMagick incorrectly handled certain images. An attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-61866)

    It was discovered that ImageMagick incorrectly handled certain images on 32-bit systems. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-62946)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21635-1 advisory.

    - CVE-2026-56365: memory leak in the PNG encoder when writing MNG images (bsc#1270004).
    - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument (bsc#1272582).
    - CVE-2026-62946: integer overflow in JNX decoder leading to heap buffer overwrite when extremely large     files are       processed on 32-bit builds (bsc#1272580).
    - CVE-2026-66011: memory leak in the magick command-line interface when invalid options are provided     (bsc#1272577).
    - CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check (bsc#1272953).
    - Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has a version of ImageMagick installed that is prior to 6.9.13-52 or 7.x prior to 7.1.2-27. It is, therefore, affected by a heap buffer over-write vulnerability:

  - Processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer     over-write. (CVE-2026-62946)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3414-1 advisory.

    - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument (bsc#1272582).
    - CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing     extremely large       files on 32-bit builds (bsc#1272580).
    - CVE-2026-66011: memory leak in the magick command-line interface when invalid options are provided     (bsc#1272577).
    - GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797     (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3413-1 advisory.

    - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing     extremely large       files on 32-bit builds (bsc#1272580).
    - GHSA-hc76-7mpc-qjqh: code injection in HTML encoder due to incomplete fix of CVE-2026-25797     (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3412-1 advisory.

    - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided     (bsc#1272575).
    - CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing     extremely large       files on 32-bit builds (bsc#1272580).
    - code injection in HTML encoder due to incomplete fix of CVE-2026-25797 (bsc#1272579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions     prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause     an integer overflow, leading to a heap buffer over-write. This issue has been fixed in versions 6.9.13-52     and 7.1.2-27. (CVE-2026-62946)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions
    prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause
    an integer overflow, leading to a heap buffer over-write. This issue has been fixed in versions 6.9.13-52
    and 7.1.2-27. (CVE-2026-62946)

ID	Name	Product	Family	Type	Severity
344613	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8739-1)	Nessus	Ubuntu Local Security Checks	Local	critical
341164	openSUSE 16: ImageMagick / ImageMagick-config-7-SUSE / etc (openSUSE-SU-2026:21635-1)	Nessus	SuSE Local Security Checks	Local	medium
334465	ImageMagick < 6.9.13-52 / 7.x < 7.1.2-27 Heap Buffer Over-write (CVE-2026-62946)	Nessus	Misc.	Local	medium
331432	SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3414-1)	Nessus	SuSE Local Security Checks	Local	medium
331429	SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3413-1)	Nessus	SuSE Local Security Checks	Local	medium
331422	SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:3412-1)	Nessus	SuSE Local Security Checks	Local	medium
330924	Linux Distros Unpatched Vulnerability : CVE-2026-62946	Nessus	Misc.	Local	medium
445263	SCA: security update for Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-x86, Magick.NET-Q16-x86, Magick.NET-Q8-AnyCPU, Magick.NET-Q8-x86 (GHSA-h22j-f9xw-xjjm)	Tenable Cloud Security	SCA Checks	Local	medium
445263	SCA: security update for Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-AnyCPU, Magick.NET-Q16-HDRI-x86, Magick.NET-Q16-x86, Magick.NET-Q8-AnyCPU, Magick.NET-Q8-x86 (GHSA-h22j-f9xw-xjjm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-62946

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium