Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A flaw in how it handles JP2 (JPEG 2000) images could allow a local attacker to cause a minor memory error by providing specific image processing options. This could lead to a program crash, potentially disrupting automated image processing workflows.
Technical details
An off-by-one error (CWE-193) in the JP2 encoder of ImageMagick leads to a single-byte heap buffer overwrite (CWE-787). The vulnerability is triggered by an incorrect bounds check when specific image processing options are used during JP2 conversion. An attacker with local access can exploit this to cause a denial-of-service (application crash) by providing a specially crafted set of options or image data. The issue is fixed in versions 6.9.13-48 and 7.1.2-23.
Affected products
- ImageMagick ImageMagick < 6.9.13-48, < 7.1.2-23
Timeline
- 2026-05-17: advisory: Initial GitHub security advisory published
- 2026-06-10: disclosed: NVD publication date