Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its MAT file decoder on 32-bit systems could allow an attacker to crash the application or potentially execute unauthorized code by providing a specially crafted image. This could lead to service interruptions or system instability in environments processing user-uploaded images.
Technical details
A heap-based buffer overflow (CWE-122) exists in ImageMagick's MAT decoder specifically on 32-bit architectures. The vulnerability is caused by a missing check of a return value during memory allocation or processing, which allows a heap buffer overwrite. An attacker can exploit this by providing a maliciously crafted MAT image file over the network. While the attack complexity is rated as high, successful exploitation primarily impacts system availability. The issue is addressed in Magick.NET version 14.14.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-x86 < 14.14.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-x86 < 14.14.0
Timeline
- 2026-05-30: disclosed
- 2026-05-30: patched: Magick.NET 14.14.0 released
- 2026-06-25: advisory