Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting images. A vulnerability has been identified where processing a specially crafted image can cause the application to crash. This could lead to a denial-of-service, impacting the availability of services that rely on this library for image processing.
Technical details
A use-after-free (UAF) vulnerability exists in ImageMagick's CheckPrimitiveExtent function. The flaw is triggered when a memory allocation failure occurs within this component, leading the program to reference memory that has already been freed. An attacker can exploit this over a network by providing a malicious image file designed to trigger the allocation failure. Successful exploitation results in a heap-use-after-free condition and a subsequent application crash (Denial of Service). The issue is addressed in Magick.NET version 14.14.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-arm64 < 14.14.0
- ImageMagick Magick.NET-Q16-x64 < 14.14.0
- ImageMagick Magick.NET-Q16-x86 < 14.14.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-arm64 < 14.14.0
- ImageMagick Magick.NET-Q8-x64 < 14.14.0
- ImageMagick Magick.NET-Q8-x86 < 14.14.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: patched: Magick.NET 14.14.0 released
- 2026-06-26: advisory