ImageMagick is free and open-source software used for editing and manipulating digital images

#!/usr/bin/env bash
# check-cve-2026-28691.sh
# Detect likely exposure to CVE-2026-28691 in ImageMagick.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

CVE="CVE-2026-28691"
UPSTREAM_FIXED_7="7.1.2-16"
UPSTREAM_FIXED_6="6.9.13-41"

# Debian backport fixed versions from Debian security tracker
DEB_FIXED_BULLSEYE="8:6.9.11.60+dfsg-1.3+deb11u11"
DEB_FIXED_BOOKWORM="8:6.9.11.60+dfsg-1.6+deb12u8"
DEB_FIXED_TRIXIE="8:7.1.1.43+dfsg1-1+deb13u7"
DEB_FIXED_UNSTABLE="8:7.1.2.16+dfsg1-1"

# Oracle Linux 7 ELS fixed package seen in vendor errata
OL7_FIXED="6.9.10.68-7.0.9.el7_9"

say() { printf '%s\n' "$*"; }

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_ge() {
  # generic version compare using sort -V
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

check_upstream_binary() {
  local bin ver major
  for bin in magick convert; do
    if have_cmd "$bin"; then
      ver=$("$bin" -version 2>/dev/null | awk '/^Version: ImageMagick /{print $3; exit}')
      if [ -n "${ver:-}" ]; then
        say "Found ImageMagick binary: $bin version $ver"
        major=${ver%%.*}
        if [ "$major" = "7" ]; then
          if ver_ge "$ver" "$UPSTREAM_FIXED_7"; then
            say "PATCHED: upstream 7.x version is >= $UPSTREAM_FIXED_7"
            exit 0
          else
            say "VULNERABLE: upstream 7.x version is < $UPSTREAM_FIXED_7"
            exit 1
          fi
        elif [ "$major" = "6" ]; then
          if ver_ge "$ver" "$UPSTREAM_FIXED_6"; then
            say "PATCHED: upstream 6.x version is >= $UPSTREAM_FIXED_6"
            exit 0
          else
            # Old distro packages may be backported; do not hard-fail yet if package manager exists
            if ! have_cmd dpkg-query && ! have_cmd rpm; then
              say "VULNERABLE: upstream 6.x version is < $UPSTREAM_FIXED_6 and no package metadata is available"
              exit 1
            fi
            say "Upstream 6.x version appears old; checking distro package metadata for backports..."
          fi
        fi
      fi
    fi
  done
}

check_dpkg() {
  local pkg ver codename
  if ! have_cmd dpkg-query; then
    return 1
  fi

  pkg=""
  for p in imagemagick imagemagick-6.q16 imagemagick-6-common imagemagick-7-common; do
    if dpkg-query -W -f='${Status}\n' "$p" 2>/dev/null | grep -q 'install ok installed'; then
      pkg="$p"
      break
    fi
  done

  [ -n "$pkg" ] || return 1
  ver=$(dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null)
  codename=$( . /etc/os-release 2>/dev/null; printf '%s' "${VERSION_CODENAME:-}" )

  say "Found Debian package: $pkg version $ver${codename:+ ($codename)}"

  if have_cmd dpkg --compare-versions; then
    case "$codename" in
      bullseye)
        if dpkg --compare-versions "$ver" ge "$DEB_FIXED_BULLSEYE"; then
          say "PATCHED: Debian bullseye package is >= $DEB_FIXED_BULLSEYE"
          exit 0
        else
          say "VULNERABLE: Debian bullseye package is < $DEB_FIXED_BULLSEYE"
          exit 1
        fi
        ;;
      bookworm)
        if dpkg --compare-versions "$ver" ge "$DEB_FIXED_BOOKWORM"; then
          say "PATCHED: Debian bookworm package is >= $DEB_FIXED_BOOKWORM"
          exit 0
        else
          say "VULNERABLE: Debian bookworm package is < $DEB_FIXED_BOOKWORM"
          exit 1
        fi
        ;;
      trixie)
        if dpkg --compare-versions "$ver" ge "$DEB_FIXED_TRIXIE"; then
          say "PATCHED: Debian trixie package is >= $DEB_FIXED_TRIXIE"
          exit 0
        else
          say "VULNERABLE: Debian trixie package is < $DEB_FIXED_TRIXIE"
          exit 1
        fi
        ;;
      sid|forky|unstable)
        if dpkg --compare-versions "$ver" ge "$DEB_FIXED_UNSTABLE"; then
          say "PATCHED: Debian unstable/forky package is >= $DEB_FIXED_UNSTABLE"
          exit 0
        else
          say "VULNERABLE: Debian unstable/forky package is < $DEB_FIXED_UNSTABLE"
          exit 1
        fi
        ;;
      *)
        # Unknown Debian-family release; use changelog if available, otherwise unknown
        if zgrep -R "$CVE" /usr/share/doc/imagemagick*/changelog* 2>/dev/null | grep -q "$CVE"; then
          say "PATCHED: local Debian changelog references $CVE"
          exit 0
        fi
        say "UNKNOWN: Debian-family package found, but release-specific backport baseline is not coded here"
        exit 2
        ;;
    esac
  fi

  return 1
}

check_rpm() {
  local pkg nvr osid osver
  if ! have_cmd rpm; then
    return 1
  fi

  pkg=""
  for p in ImageMagick ImageMagick7 imagemagick; do
    if rpm -q "$p" >/dev/null 2>&1; then
      pkg="$p"
      break
    fi
  done
  [ -n "$pkg" ] || return 1

  nvr=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null)
  osid=$( . /etc/os-release 2>/dev/null; printf '%s' "${ID:-}" )
  osver=$( . /etc/os-release 2>/dev/null; printf '%s' "${VERSION_ID:-}" )

  say "Found RPM package: $pkg $nvr${osid:+ on $osid $osver}"

  if rpm -q --changelog "$pkg" 2>/dev/null | grep -q "$CVE"; then
    say "PATCHED: RPM changelog explicitly references $CVE"
    exit 0
  fi

  if [ "$osid" = "ol" ] && [ "$osver" = "7" ]; then
    if ver_ge "$nvr" "$OL7_FIXED"; then
      say "PATCHED: Oracle Linux 7 package is >= $OL7_FIXED"
      exit 0
    else
      say "VULNERABLE: Oracle Linux 7 package is < $OL7_FIXED"
      exit 1
    fi
  fi

  # For other RPM distros, err on the side of unknown unless upstream binary clearly says fixed.
  say "UNKNOWN: RPM package present, but no explicit local evidence of the backport for $CVE was found"
  exit 2
}

main() {
  check_upstream_binary
  check_dpkg
  check_rpm

  say "UNKNOWN: could not determine whether ImageMagick is installed and fixed for $CVE"
  exit 2
}

main "$@"