CVE-2023-1906: Fedoraproject Extra Packages For Enterprise Linux

Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: version 8.0 only
• Fedoraproject Fedora: version 37 only
• ImageMagick ImageMagick: before 6.9.12-84 (fixed in 6.9.12-84); version 7.1.1-4 only

Published 2023-04-12. Last modified 2026-06-17.