Executive brief
ImageMagick is a widely used open-source tool for creating, editing, and converting digital images. A security flaw has been identified where processing a specially crafted image file can cause the software to crash or potentially expose sensitive information. This could disrupt services that rely on ImageMagick for automated image processing or allow unauthorized access to data.
Technical details
A stack-based buffer overflow (CWE-121) exists in ImageMagick's msl.c component. The vulnerability is triggered when the software processes a long value for a specific attribute within a Magick Scripting Language (MSL) file, which overflows a fixed-size stack buffer. This leads to an out-of-bounds write and subsequent memory corruption. An attacker can exploit this over a network without authentication, though the attack complexity is rated as high. Successful exploitation can result in a crash (denial of service) or the leakage of sensitive information from memory. The issue is resolved in versions 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40
Timeline
- 2026-02-23: advisory: GitHub Security Advisory published
- 2026-02-24: disclosed: NVD publication date
- 2026-02-23: patched: Patch released in versions 7.1.2-15 and 6.9.13-40