Executive brief
ImageMagick is a widely used open-source tool for creating, editing, and converting digital images. A security flaw in its distributed pixel cache service could allow an attacker with high-level access to the system to crash the software or potentially access sensitive information from the computer's memory. This could lead to service interruptions or unauthorized data exposure in environments where ImageMagick is used for large-scale image processing.
Technical details
A heap buffer over-read vulnerability (CWE-125) exists in the ImageMagick 'magick -distribute-cache' service. The flaw is triggered when the server process improperly validates memory boundaries while processing requests from the distributed pixel cache. An attacker with local access and high privileges can exploit this vulnerability to read data beyond the intended buffer, potentially leading to information disclosure or a process crash (denial of service). The vulnerability also involves improper authentication (CWE-287) within the service. Patches are available in versions 6.9.13-48 and 7.1.2-23.
Affected products
- ImageMagick ImageMagick < 6.9.13-48, < 7.1.2-23
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD