Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a use-after-free vulnerability in the RSVG decoder when built without cairo support, triggered when a limit is hit during decoding. Attackers can supply crafted SVG files that cause a limit to be reached, leading to access of freed memory and a crash.
The Fedora EPEL ImageMagick package is not affected. CVE-2026-105824 only affects ImageMagick built without Cairo support. Verification of the packaged build shows: Delegates (built-in): ... cairo ... pangocairo ... rsvg ... libcairo.so.2()(64bit) Therefore, the vulnerable non-Cairo RSVG decoder path is not used. The current leading EPEL 10 build is also newer than the upstream fixed version 7.1.2-30. EPEL 8 and EPEL 9 ship versions newer than the fixed ImageMagick 6 version 6.9.13-55. Closing as NOTABUG because the affected build configuration is not used.