CVE-2026-55628

NameCVE-2026-55628
DescriptionIn versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4680-1, DSA-6383-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
imagemagick (PTS)bullseye8:6.9.11.60+dfsg-1.3+deb11u4vulnerable
bullseye (security)8:6.9.11.60+dfsg-1.3+deb11u16fixed
bookworm8:6.9.11.60+dfsg-1.6+deb12u11vulnerable
bookworm (security)8:6.9.11.60+dfsg-1.6+deb12u13fixed
trixie8:7.1.1.43+dfsg1-1+deb13u10vulnerable
trixie (security)8:7.1.1.43+dfsg1-1+deb13u11fixed
forky, sid8:7.1.2.27+dfsg1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
imagemagicksourcebullseye8:6.9.11.60+dfsg-1.3+deb11u15DLA-4680-1
imagemagicksourcebookworm8:6.9.11.60+dfsg-1.6+deb12u12DLA-4680-1
imagemagicksourcetrixie8:7.1.1.43+dfsg1-1+deb13u11DSA-6383-1
imagemagicksource(unstable)8:7.1.2.26+dfsg1-1

Notes

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-82mp-vp5c-9pf7
Fixed by: https://github.com/ImageMagick/ImageMagick/commit/dcba7ee9ffb0c5a22a458bf0c613bc818fcb4cc6 (7.1.2-26)
Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/f48a0e2bad74c4cd42624e95205c3befd64062d8 (6.9.13-53)

Search for package or bug name: Reporting problems