Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its JPEG 2000 (JP2) processing component could allow a specially crafted image to crash the application. This could lead to a service outage or denial-of-service for systems that automatically process user-uploaded images.
Technical details
A heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) exist in the ImageMagick JP2 encoder. The root cause is improper validation of a user-specified sampling index during image encoding. An attacker can exploit this by providing a crafted image or configuration that triggers an out-of-bounds write on the heap. This is a local attack vector requiring user interaction (e.g., opening a malicious file) and primarily impacts system availability by causing a crash. The issue is resolved in ImageMagick 7.1.2-19 and Magick.NET 14.12.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-x86 < 14.12.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-x86 < 14.12.0
- ImageMagick ImageMagick < 7.1.2-19
Timeline
- 2026-04-13: advisory: NVD publication date
- 2026-04-14: disclosed: GitHub Advisory published
- 2026-04-14: patched: GitHub Advisory reviewed and updated with patch info