View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2026-25966 severity moderate: SUSE including 88 source package names (2.2.1-5.54:rsync-3.3.0-slfo.1.1_4.1, 2.2.1-5.62:rsync-3.3.0-slfo.1.1_4.1, …), 255 product×package rows across 40 product lines (Container suse/sl-micro/6.1/baremetal-os-container, Container suse/sl-micro/6.1/base-os-container, … (40 product lines)): Fixed 225, Known Not Affected 16, First Fixed 14.
ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd:<n> pseudo-filenames (e.g., fd:0, fd:1). Prior to versions 7.1.2-15 and 6.9.13-40, this path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of "no stdin/stdout." Versions 7.1.2-15 and 6.9.13-40 contain a patch by including a change to the more secure policies by default. As a workaround, add the change to one's security policy manually.