Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A security flaw has been identified where processing a specially crafted image file could cause the software to read memory outside of its intended boundaries. This could potentially lead to minor data exposure or cause the application to crash, affecting service availability.
Technical details
An out-of-bounds read vulnerability exists in ImageMagick's IPTC encoder. The root cause is an integer underflow (CWE-191) that occurs when writing an IPTC output file, leading to a single-byte heap buffer over-read (CWE-125). An attacker can exploit this by providing a malicious input file to be processed by the library. While the impact is limited to a single-byte read, it can result in a crash (DoS) or limited information disclosure. The issue is fixed in versions 6.9.13-47 and 7.1.2-22.
Affected products
- ImageMagick ImageMagick < 6.9.13-47, < 7.1.2-22
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD