ALAS2-2026-3786

References: CVE-2026-56368  CVE-2026-56370  CVE-2026-56371  CVE-2026-56378  CVE-2026-56379 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service. (CVE-2026-56368)

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution. (CVE-2026-56370)

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed. (CVE-2026-56371)

ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte. (CVE-2026-56378)

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. (CVE-2026-56379)

Issue Correction:
Run yum update ImageMagick or yum update --advisory ALAS2-2026-3786 to update your system.

New Packages:

aarch64:
    ImageMagick-6.9.10.97-1.amzn2.0.31.aarch64
    ImageMagick-devel-6.9.10.97-1.amzn2.0.31.aarch64
    ImageMagick-doc-6.9.10.97-1.amzn2.0.31.aarch64
    ImageMagick-perl-6.9.10.97-1.amzn2.0.31.aarch64
    ImageMagick-c++-6.9.10.97-1.amzn2.0.31.aarch64
    ImageMagick-c++-devel-6.9.10.97-1.amzn2.0.31.aarch64
    ImageMagick-debuginfo-6.9.10.97-1.amzn2.0.31.aarch64

i686:
    ImageMagick-6.9.10.97-1.amzn2.0.31.i686
    ImageMagick-devel-6.9.10.97-1.amzn2.0.31.i686
    ImageMagick-doc-6.9.10.97-1.amzn2.0.31.i686
    ImageMagick-perl-6.9.10.97-1.amzn2.0.31.i686
    ImageMagick-c++-6.9.10.97-1.amzn2.0.31.i686
    ImageMagick-c++-devel-6.9.10.97-1.amzn2.0.31.i686
    ImageMagick-debuginfo-6.9.10.97-1.amzn2.0.31.i686

src:
    ImageMagick-6.9.10.97-1.amzn2.0.31.src

x86_64:
    ImageMagick-6.9.10.97-1.amzn2.0.31.x86_64
    ImageMagick-devel-6.9.10.97-1.amzn2.0.31.x86_64
    ImageMagick-doc-6.9.10.97-1.amzn2.0.31.x86_64
    ImageMagick-perl-6.9.10.97-1.amzn2.0.31.x86_64
    ImageMagick-c++-6.9.10.97-1.amzn2.0.31.x86_64
    ImageMagick-c++-devel-6.9.10.97-1.amzn2.0.31.x86_64
    ImageMagick-debuginfo-6.9.10.97-1.amzn2.0.31.x86_64