Executive brief
ImageMagick, a widely used software suite for displaying and editing image files, is affected by a memory handling flaw. An attacker could exploit this by providing a specially crafted image or specific image processing parameters, potentially causing the application to crash. This could lead to a temporary disruption of services that rely on ImageMagick for automated image processing.
Technical details
An off-by-one error (CWE-193) exists in the morphology validation component of ImageMagick. The vulnerability is triggered when the software processes incorrect morphology parameters, leading to an out-of-bounds read (CWE-125) on the heap. Specifically, the flaw allows for a single-pixel memory access violation. While the impact is primarily limited to a denial-of-service (application crash), exploitation requires a local attacker to convince a user to process a malicious input (User Interaction Required). The issue is resolved in versions 7.1.2-19 and 6.9.13-44.
Affected products
- ImageMagick ImageMagick < 7.1.2-19, < 6.9.13-44
Timeline
- 2026-04-13: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date