Executive brief
ImageMagick, a widely used suite for displaying and converting images, is vulnerable to a memory corruption issue when processing certain image files. An attacker could provide a specially crafted image with a mask that, when processed using specific dithering settings, causes the application to crash. This could lead to a denial-of-service, impacting the availability of services that rely on this library for image processing.
Technical details
A heap buffer underwrite (CWE-787) exists in ImageMagick's Floyd-Steinberg depth dithering implementation. The vulnerability is triggered when processing an image that contains a mask, leading to a negative heap buffer overwrite. An attacker can exploit this by providing a malicious image file to be processed by a vulnerable version of the library. Successful exploitation results in a crash (denial of service), though the CVSS score indicates no immediate impact on confidentiality or integrity. The issue is addressed in Magick.NET version 14.14.0.
Affected products
- ImageMagick Magick.NET < 14.14.0
Timeline
- 2026-05-30: disclosed: Initial disclosure to ImageMagick repository
- 2026-06-10: advisory: NVD publication date
- 2026-06-25: patched: GitHub Advisory reviewed and updated with patch information