Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its MVG image decoder allows an attacker to crash applications that process specially crafted images. This could lead to a service outage or denial-of-service condition for websites or tools that rely on this library to handle user-uploaded images.
Technical details
A stack overflow vulnerability exists in ImageMagick's Magick Vector Graphics (MVG) decoder due to uncontrolled recursion. The root cause is a missing depth check during the decoding process, which allows a specially crafted MVG image to exhaust the program stack. An attacker can exploit this over the network without authentication or user interaction by providing a malicious image file to a vulnerable application. This results in a crash (denial of service). The issue is addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: Magick.NET 14.15.0 released
- 2026-07-01: advisory: NVD published date
- 2026-07-24: advisory: GitHub Advisory published date