Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting images. A vulnerability in its JPEG 2000 (JP2) encoder could allow an attacker to crash applications that process specially crafted image files. This could lead to a service outage or application instability when handling untrusted user-uploaded images.
Technical details
A heap buffer overwrite vulnerability exists in ImageMagick's JP2 encoder component. The flaw is rooted in CWE-682 (Incorrect Calculation) and CWE-787 (Out-of-bounds Write), where improper handling of arguments during the encoding process leads to memory corruption. An attacker can exploit this by providing a specially crafted file or set of parameters that triggers an out-of-bounds write on the heap. While the primary impact is on application availability (Denial of Service), exploitation requires local access and user interaction (e.g., a user or automated process attempting to encode a malicious file). The issue is addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick.NET Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: patched: Fix released in Magick.NET 14.15.0
- 2026-07-01: advisory: NVD publication date
- 2026-07-24: disclosed: GitHub Advisory published