Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its ICON file decoder allows a specially crafted image to cause the application to crash. This could lead to a service outage or denial-of-service for applications that process user-uploaded images.
Technical details
An out-of-bounds (OOB) write vulnerability (CWE-787) exists in the ImageMagick ICON decoder. The flaw is caused by an incorrect loop implementation during the decoding process, which allows data to be written past the boundaries of the allocated heap buffer. An attacker can exploit this by providing a maliciously crafted ICON file, potentially delivered over a network if the application processes external images. Successful exploitation results in a memory corruption that triggers an application crash (Denial of Service). The vulnerability is addressed in Magick.NET version 14.14.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-x86 < 14.14.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-x86 < 14.14.0
Timeline
- 2026-06-09: disclosed: Initial disclosure to ImageMagick repository
- 2026-06-10: advisory: NVD publication date
- 2026-06-25: patched: GitHub Advisory published and reviewed with patch information