ImageMagick affected by stack corruption through long morphology kernel names or arrays
Summary
ImageMagick affected by stack corruption through long morphology kernel names or arrays
Original description
The description as published by the source.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-28494 imagemagick Fixed in: 8:6.9.11.60+dfsg-1.3+deb11u11
- Ubuntu UBUNTU-CVE-2026-28494 imagemagick
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov