CVE-2026-31853

A flaw was found in ImageMagick. An overflow on 32-bit systems in the SFW decoder can lead to a crash when processing extremely large images. This vulnerability could allow an attacker to cause a Denial of Service (DoS) by providing a specially crafted large image.

This MODERATE impact flaw in ImageMagick affects 32-bit systems. An attacker could trigger a denial of service by providing a specially crafted, extremely large image for processing by the SFW decoder. This vulnerability is applicable to Red Hat Enterprise Linux 6 ELS and 7 ELS when running on 32-bit architectures.

It is important to note that ImageMagick has been removed from Red Hat Enterprise Linux 8 and later releases. Therefore, current supported RHEL 8 and newer systems are not affected by this issue unless ImageMagick is installed from third-party or custom repositories.

For additional information, refer to https://access.redhat.com/solutions/4437561.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.

To reduce the risk of denial of service, avoid processing untrusted or excessively large SFW (Structured Fax File) images with ImageMagick on 32-bit systems.