Executive brief
ImageMagick, a widely used tool for processing and editing images, is affected by a security flaw in its XCF image format decoder. By providing a specially crafted image file, an attacker could cause the application to crash or potentially access small amounts of memory it shouldn't be able to see. This could lead to service interruptions for applications that automatically process user-uploaded images.
Technical details
A heap buffer over-read vulnerability exists in ImageMagick's XCF decoder due to an integer conversion overflow (CWE-190, CWE-681). The flaw occurs when the decoder performs incorrect numeric type conversions during the processing of a crafted XCF image, leading to an out-of-bounds read. An attacker can exploit this by providing a malicious image file to be processed by the library, requiring no authentication or specific user interaction beyond the processing itself. This can result in a denial-of-service (crash) or limited information disclosure. The issue is addressed in ImageMagick version 7.1.2-26 and Magick.NET version 14.15.0.
Affected products
- ImageMagick ImageMagick < 7.1.2-26
- dlemstra Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed: Initial disclosure by reporter Bin-infinite
- 2026-07-01: advisory: NVD publication date
- 2026-07-31: patched: GitHub Advisory published and reviewed