The update for ImageMagick fixes several security issues: CVE-2026-55628 addresses a policy bypass in the concatenate operation due to missing checks; CVE-2026-56362 is a heap-buffer-overflow read caused by metadata-cache desynchronization in OpenPixelCache; CVE-2026-56366 fixes a memory leak in the META reader's APP1JPEG input path; CVE-2026-56372 resolves a heap buffer overflow read in the magnify operation triggered by an unrecognized magnify:method value; CVE-2026-56373 patches a possible use-after-free write in the PDB decoder; CVE-2026-56377 corrects a policy bypass that could create or truncate files; CVE-2026-61465 addresses a policy bypass possible with matrix-backed operations; CVE-2026-61857 fixes a heap-use-after-free via XMP profile that could cause a crash; CVE-2026-61858 resolves a policy bypass in the APNG encoder and delegates due to a missing check; CVE-2026-61861 patches a use-after-free in FormatMagickCaption when memory allocation fails; and CVE-2026-61870 fixes a memory leak in the VIFF encoder when allocation fails. These fixes collectively improve the security posture of ImageMagick by addressing multiple memory safety and policy enforcement issues.

The vulnerabilities could lead to unauthorized policy bypasses allowing unintended file creation or truncation, memory corruption through heap buffer overflows and use-after-free conditions, memory leaks, and potential application crashes. These issues may affect the reliability and security of ImageMagick when processing certain image operations and formats.

A security update for ImageMagick has been released that addresses all listed vulnerabilities. Users should apply this update promptly to remediate these issues. No additional mitigation steps are indicated beyond applying the official fix.