Debian 11 imagemagick Critical DoS Stack Overflow Advisory DLA-4448-1

CVE-2026-23874

A stack overflow via infinite recursion was found
in MSL (Magick Scripting Language) `` command when writing to
MSL format

CVE-2026-23876

A heap buffer overflow vulnerability was found in the XBM image decoder
(ReadXBMImage) allows an attacker to write controlled data past the
allocated heap buffer when processing a maliciously crafted image file.
Any operation that reads or identifies an image can trigger the overflow,
making it exploitable via common image upload and processing pipelines

CVE-2026-23952

A NULL pointer dereference vulnerability was found in the MSL
(Magick Scripting Language) parser when processing tags before
images are loaded. This can lead to DoS attack (Deny of Service)

For Debian 11 bullseye, these problems have been fixed in version
8:6.9.11.60+dfsg-1.3+deb11u9.

We recommend that you upgrade your imagemagick packages.

For the detailed security status of imagemagick please refer to
its security tracker page at: