Executive brief
ImageMagick is a widely used software suite for editing and processing digital images. A vulnerability in how it handles specific mathematical image filters (binomial kernels) could allow an attacker to crash the application by providing a specially crafted image or command. This results in a denial-of-service, potentially disrupting automated image processing workflows or applications that rely on ImageMagick.
Technical details
A division by zero vulnerability exists in ImageMagick's binomial kernel processing logic. The flaw is rooted in an integer overflow (CWE-190) that occurs when a user supplies an excessively large binomial kernel value. This overflow results in a zero value being used in a subsequent division operation (CWE-369), leading to an application crash. Exploitation requires local access and user interaction, such as a user being tricked into processing a malicious file. The issue is resolved in versions 7.1.2-22 and 6.9.13-47.
Affected products
- ImageMagick ImageMagick < 7.1.2-22, < 6.9.13-47
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date