This advisory covers nine security vulnerabilities in ImageMagick, including denial of service (DoS) flaws such as out-of-bounds writes (CVE-2026-46520), crafted MIFF file processing (CVE-2026-46522), excessive resource use in MNG coder (CVE-2026-45664), resource policy bypass in PSD decoder (CVE-2026-45031), heap-use-after-free via crafted MSL image (CVE-2026-46523), heap buffer over-write via service connection (CVE-2026-46692), missing memory request check (CVE-2026-53460), and crafted DCM image with invalid dimensions (CVE-2026-49218). Critically, an arbitrary code execution vulnerability exists via SVG decoder command injection (CVE-2026-56379). These vulnerabilities affect ImageMagick packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The advisory references fixes available via updated packages and provides links for remediation.

The vulnerabilities collectively allow attackers to cause denial of service conditions through various malformed image inputs, potentially crashing or destabilizing the ImageMagick service. The most severe issue enables arbitrary code execution via the SVG decoder, which could allow an attacker to execute code remotely with the privileges of the ImageMagick process. These issues pose significant risks to systems processing untrusted image files.

Red Hat has released security updates for ImageMagick in Red Hat Enterprise Linux 7 Extended Lifecycle Support that address all listed vulnerabilities. Users should apply these official patches promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided updates.