Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A security flaw has been identified where a specially crafted image file can cause the application to crash when a user interacts with it using the 'display' tool. This could lead to a denial-of-service, disrupting operations for users processing untrusted image files.
Technical details
A stack-based buffer overflow (CWE-121) exists in ImageMagick's XTileImage component within the 'display' tool. The vulnerability is triggered when a user opens a specially crafted Magick Image File Format (MIFF) file and performs a specific UI action: right-clicking a tile to invoke the 'Load / Update' menu item. This is a local attack requiring user interaction. Successful exploitation results in a crash (High Availability impact), though the current CVSS assessment indicates no impact on Confidentiality or Integrity. The issue is resolved in versions 7.1.2-21 and 6.9.13-46.
Affected products
- ImageMagick ImageMagick < 7.1.2-21, < 6.9.13-46
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD