Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its MVG (Magick Vector Graphics) decoder allows a specially crafted image file to crash the application. This could lead to a denial-of-service, potentially disrupting automated image processing workflows or applications that rely on this library.
Technical details
A stack overflow vulnerability exists in ImageMagick's MVG (Magick Vector Graphics) decoder due to uncontrolled recursion (CWE-674). The root cause is a missing depth or visited-set check during the decoding process. An attacker can exploit this by providing a specially crafted MVG file, which triggers excessive recursion and consumes the program stack. This is a local attack requiring user interaction (opening the file) and results in a denial-of-service (application crash). The issue is addressed in Magick.NET version 14.14.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-x86 < 14.14.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-x86 < 14.14.0
Timeline
- 2026-05-30: patched: Fix released in Magick.NET 14.14.0
- 2026-06-10: advisory: NVD publication date
- 2026-06-25: disclosed: GitHub Advisory published