The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1774999144 advisory.

  - ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9     and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its     ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header     and calculates image_size = 2 * width * height without checking for overflow. On 32-bit systems (or where     size_t is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping     around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later     operations relying on the dimensions can trigger an out of bounds read. This issue is fixed in version     7.1.2-10. (CVE-2025-66628)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage()     function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to     become unresponsive and continuously consume CPU resources, ultimately leading to system resource     exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch. (CVE-2026-24485)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to     attempt to allocate ~674 GB of memory, leading to an out-of-memory abort. Versions 7.1.2-15 and 6.9.13-40     contain a patch. (CVE-2026-25985)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary     check (`>` instead of `>=`) that allows bypass the guard and reach an undefined `(size_t)` cast. Versions     7.1.2-15 and 6.9.13-40 contain a patch. (CVE-2026-25989)

  - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to     versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing     functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via     memcpy without bounds checking, resulting in stack corruption. This vulnerability is fixed in 7.1.2-16 and     6.9.13-41. (CVE-2026-28494)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1774999144)

high Nessus Plugin ID 361190

Version 1.2