SB20260105122 - SUSE update for ImageMagick
Published: January 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2025-65955)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the Options::fontFamily() function. A remote attacker can pass a specially crafted image file to the application, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Integer overflow (CVE-ID: CVE-2025-66628)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to integer overflow in TIM decoder within the ReadTIMImage() function in coders/tim.c. A remote attacker can pass specially crafted image data to the application, trigger an integer overflow and read sensitive information.
The vulnerability affects 32-bit systems only.
3) Heap-based buffer overflow (CVE-ID: CVE-2025-68469)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted TIFF image to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.