Executive brief
ImageMagick is a widely used open-source tool for creating, editing, and converting digital images. A vulnerability in its image processing logic allows a specially crafted file or command to crash the application. This can lead to a denial-of-service, potentially disrupting automated workflows or web services that rely on ImageMagick to process user-uploaded images.
Technical details
A stack-based buffer overflow vulnerability exists in ImageMagick's 'fx' operation due to uncontrolled recursion (CWE-674). The software fails to implement a proper depth check when processing arguments, allowing an attacker to trigger a stack overflow. This vulnerability is exploitable locally by providing a specially crafted argument to the affected component. Successful exploitation results in a crash of the application, leading to a denial-of-service (DoS) condition. The issue is resolved in ImageMagick version 7.1.2-23.
Affected products
- ImageMagick ImageMagick < 7.1.2-23
Timeline
- 2026-05-17: advisory: GitHub advisory published by maintainers
- 2026-06-10: disclosed: CVE published to NVD
- 2026-06-10: patched: Fix confirmed in version 7.1.2-23