crítica
CVE-2026-25897
ImageMagick: ImageMagick: Out-of-bounds heap write via integer overflow in sun decoder
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Julia, Photon OS. Más baja según GHSA (media), Red Hat (media), Ubuntu (media).
Descripción
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | ImageMagick_jll | 7.1.2023+0 |
| Photon OS 4.0 | ImageMagick, ImageMagick-c++, ImageMagick-c++-devel y 3 más | 7.1.2.16-1.ph4 |
| Photon OS 5.0 | ImageMagick, ImageMagick-c++, ImageMagick-c++-devel y 3 más | 7.1.2.16-1.1.ph5 |
| alpine 3.22 | imagemagick | 7.1.2.15-r0 |
| alpine 3.23 | imagemagick | 7.1.2.15-r0 |
| alpine 3.24 | imagemagick | 7.1.2.15-r0 |
| alpine edge | imagemagick | 7.1.2.15-r0 |
| debian 11 | imagemagick | 8:6.9.11.60+dfsg-1.3+deb11u10 |
| debian 12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 |
| debian 13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 |
| debian 14 | imagemagick | 8:7.1.2.15+dfsg1-1 |
| echo | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 |
Mostrar las 94 entradas de 34 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | ImageMagick_jll | 7.1.2023+0 |
| Photon OS 4.0 | ImageMagick | 7.1.2.16-1.ph4 |
| Photon OS 4.0 | ImageMagick-c++ | 7.1.2.16-1.ph4 |
| Photon OS 4.0 | ImageMagick-c++-devel | 7.1.2.16-1.ph4 |
| Photon OS 4.0 | ImageMagick-devel | 7.1.2.16-1.ph4 |
| Photon OS 4.0 | ImageMagick-doc | 7.1.2.16-1.ph4 |
| Photon OS 4.0 | ImageMagick-libs | 7.1.2.16-1.ph4 |
| Photon OS 5.0 | ImageMagick | 7.1.2.16-1.1.ph5 |
| Photon OS 5.0 | ImageMagick-c++ | 7.1.2.16-1.1.ph5 |
| Photon OS 5.0 | ImageMagick-c++-devel | 7.1.2.16-1.1.ph5 |
| Photon OS 5.0 | ImageMagick-devel | 7.1.2.16-1.1.ph5 |
| Photon OS 5.0 | ImageMagick-doc | 7.1.2.16-1.1.ph5 |
| Photon OS 5.0 | ImageMagick-libs | 7.1.2.16-1.1.ph5 |
| alpine 3.22 | imagemagick | 7.1.2.15-r0 |
| alpine 3.23 | imagemagick | 7.1.2.15-r0 |
| alpine 3.24 | imagemagick | 7.1.2.15-r0 |
| alpine edge | imagemagick | 7.1.2.15-r0 |
| debian 11 | imagemagick | 8:6.9.11.60+dfsg-1.3+deb11u10 |
| debian 12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 |
| debian 13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 |
| debian 14 | imagemagick | 8:7.1.2.15+dfsg1-1 |
| echo | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 |
| minimos | imagemagick | 7.1.2.0-r0 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-AnyCPU | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-HDRI-AnyCPU | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-HDRI-OpenMP-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-HDRI-OpenMP-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-HDRI-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-HDRI-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-HDRI-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-OpenMP-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-OpenMP-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-OpenMP-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q16-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q8-AnyCPU | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q8-OpenMP-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q8-OpenMP-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q8-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q8-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | Magick.NET-Q8-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-anycpu | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-hdri-anycpu | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-hdri-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-hdri-openmp-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-hdri-openmp-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-hdri-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-hdri-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-openmp-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-openmp-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-openmp-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q16-x86 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q8-anycpu | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q8-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q8-openmp-arm64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q8-openmp-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q8-x64 | 14.10.3 |
| nuget::GitHub Security Advisory NuGet | magick.net-q8-x86 | 14.10.3 |
| rapidfort alpine 3.20 | imagemagick | 7.1.2.15-r0 |
| rapidfort alpine 3.21 | imagemagick | 7.1.2.15-r0 |
| rapidfort debian 12 | imagemagick | 0:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.2.15+dfsg1-1 |
| rapidfort debian 12 | rf-imagemagick | 0:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.2.15+dfsg1-1 |
| rapidfort debian 13 | imagemagick | 0:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.2.15+dfsg1-1 |
| rapidfort debian 13 | rf-imagemagick | 0:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.1.43+dfsg1-1+deb13u6, 8:7.1.2.15+dfsg1-1 |
| rapidfort ubuntu 20.04 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| rapidfort ubuntu 20.04 | rf-imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | rf-imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | rf-imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| Red Hat | ImageMagick | sin corrección indicada |
| Red Hat | ImageMagick-c++ | sin corrección indicada |
| Red Hat | ImageMagick-c++-devel | sin corrección indicada |
| Red Hat | ImageMagick-devel | sin corrección indicada |
| Red Hat | ImageMagick-doc | sin corrección indicada |
| Red Hat | ImageMagick-perl | sin corrección indicada |
| root.io debian 11 | rootio-imagemagick | 8:6.9.11.60+dfsg-1.3+deb11u10 |
| root.io debian 12 | imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 |
| root.io debian 12 | rootio-imagemagick | 8:6.9.11.60+dfsg-1.6+deb12u7 |
| root.io debian 13 | imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 |
| root.io debian 13 | rootio-imagemagick | 8:7.1.1.43+dfsg1-1+deb13u6 |
| seal Red Hat 7 | imagemagick | 6.9.10.68-6.el7_9+sp999 |
| seal Red Hat 7 | seal-imagemagick | 6.9.10.68-6.el7_9+sp999 |
| ubuntu 16.04-ESM | imagemagick | 8:6.8.9.9-7ubuntu5.16+esm18 |
| ubuntu 18.04-ESM | imagemagick | 8:6.9.7.4+dfsg-16ubuntu6.15+esm10 |
| ubuntu 20.04-ESM | imagemagick | 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm8 |
| ubuntu 22.04 | imagemagick | sin corrección indicada |
| ubuntu 24.04 | imagemagick | sin corrección indicada |
| ubuntu 25.10 | imagemagick | 8:7.1.2.3+dfsg1-1ubuntu0.1 |
| ubuntu 26.04 | imagemagick | 8:7.1.2.13+dfsg1-1ubuntu1 |
| ubuntu 26.10 | imagemagick | 8:7.1.2.13+dfsg1-1ubuntu1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-25897
- https://github.com/ImageMagick/ImageMagick
- https://github.com/ImageMagick/ImageMagick/commit/23fde73188ea32c15b607571775d4f92bdb75e60
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6j5f-24fw-pqp4
- https://github.com/advisories/GHSA-6j5f-24fw-pqp4
- https://github.com/dlemstra/Magick.NET/releases/tag/14.10.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-25897
- https://ubuntu.com/security/notices/USN-8069-1