Executive brief
ImageMagick, a widely used open-source tool for image processing and manipulation, is affected by a security flaw in its MVG image decoder. An attacker could provide a specially crafted image file that, when processed by the software, causes a system crash or service instability. This could lead to a denial-of-service, impacting the availability of web applications or automated systems that rely on ImageMagick for image handling.
Technical details
A heap buffer overflow vulnerability exists in ImageMagick's Magick Vector Graphics (MVG) decoder. The flaw is rooted in improper handling of exceptional conditions (CWE-755) and insufficient checks for unusual conditions (CWE-754), resulting in an out-of-bounds write (CWE-787) when processing a maliciously crafted image. The attack vector is network-based with high complexity, requiring no prior authentication or user interaction. Successful exploitation primarily impacts system availability (Denial of Service). The issue is resolved in versions 6.9.13-51 and 7.1.2-26.
Affected products
- ImageMagick ImageMagick < 6.9.13-51, >= 7.0.1-0, < 7.1.2-26
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published by maintainers
- 2026-07-01: disclosed: NVD publication date