CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792717651)

critical Nessus Plugin ID 372117

Synopsis

The CentOS Linux host is missing one or more security updates.

Description

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792717651 advisory.

- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57. (CVE-2026-106567)

- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57. (CVE-2026-106568)

- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixed in versions 6.9.13-56 and 7.1.2-31. (CVE-2026-106571)

- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions 7.1.2-30 and 6.9.13-55.
(CVE-2026-106572)

- ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56. (CVE-2026-106577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory CENTOS7:CLSA-2026:1792717651.

Plugin Details

Severity: Critical

ID: 372117

File Name: tuxcare_centos_7_CLSA-2026-1792717651.nasl

Version: 1.1

Type: Local

Agent: unix

Family: CentOS Local Security Checks

Published: 10/26/2026

Updated: 10/26/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.7

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-106577

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 7.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-56379

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/OS/extended-third-party

Exploit Ease: No known exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 2/25/2026

Reference Information

CVE: CVE-2026-105398, CVE-2026-105825, CVE-2026-105826, CVE-2026-105827, CVE-2026-106567, CVE-2026-106568, CVE-2026-106571, CVE-2026-106572, CVE-2026-106577, CVE-2026-107210, CVE-2026-109261, CVE-2026-109262, CVE-2026-109263, CVE-2026-109266, CVE-2026-109269, CVE-2026-109273, CVE-2026-109276, CVE-2026-109278, CVE-2026-109279, CVE-2026-109282, CVE-2026-109964, CVE-2026-55628, CVE-2026-56379

CLSA: 2026:1792717651

Detections

Analytics