Description of the patch:
This update for ImageMagick fixes the following issues
- CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read
(bsc#1270073).
- CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure
(bsc#1270074).
- CVE-2026-55594: missing depth check in the MVG decoder will result in a stack overflow when a crafted image is
provided (bsc#1270077).
- CVE-2026-55595: providing invalid arguments to the
connected-components option can lead to an infinite loop
(bsc#1270079).
- CVE-2026-55597: incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder (bsc#1270080).
- CVE-2026-56361: off-by-one error in morphology validation can lead to an out-of-bounds read (bsc#1270001).
- CVE-2026-56363: integer overflow leading to a division by zero in binomial kernel processing can cause an application
crash (bsc#1270002).
- CVE-2026-56364: memory leak in
LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML
files
with unclosed device elements (bsc#1270003).
- CVE-2026-56374: missing boundary checks can lead to a heap buffer overflow in the FTXT encoder when parsing
ftxt:format (bsc#1271099).
- CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG
files (bsc#1268878).
- GHSA-3j4x-rwrx-xxj9: possible use-after-free write in PDB decoder (bsc#1268640).