Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A flaw in how it handles specific image distortion commands could allow a local attacker to read small amounts of memory that should be restricted. This could potentially lead to minor information disclosure or cause the application to crash, affecting service reliability.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in ImageMagick's polynomial distortion functionality due to improper validation of array indices (CWE-129). When processing specific arguments during a distort operation, the application may read 24 bytes beyond the intended buffer. This is a local attack vector that does not require special privileges or user interaction. An attacker could potentially exploit this to leak sensitive information from memory or cause a denial-of-service (crash). The issue is resolved in versions 6.9.13-47 and 7.1.2-22.
Affected products
- ImageMagick ImageMagick < 6.9.13-47, < 7.1.2-22
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD