Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability has been identified where processing a specially crafted image file can cause the application to crash or behave unexpectedly. This could lead to a denial-of-service, impacting the availability of services that rely on ImageMagick for automated image processing.
Technical details
A use-after-free vulnerability exists in ImageMagick when identifying an image containing a crafted 8BIM profile with a specific format string. The flaw is triggered during the image identification process, where the application references memory that has already been released. An attacker can exploit this by providing a malicious image file to a system using the Magick.NET library. Successful exploitation typically results in a crash (denial of service), though use-after-free bugs can sometimes lead to arbitrary code execution under specific memory conditions. The issue is resolved in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed: Initial disclosure by dlemstra
- 2026-07-01: advisory: NVD publication
- 2026-07-24: patched: GitHub Advisory reviewed and updated with patch information