Executive brief
ImageMagick, a widely used tool for displaying and converting images, contains a flaw in how it handles certain image metadata. An attacker could provide a specially crafted image file that, when processed, causes the software to consume excessive memory. This can lead to a system slowdown or a complete service outage (denial of service) as the computer runs out of available resources.
Technical details
A memory leak vulnerability (CWE-401) exists in ImageMagick's META reader component, specifically within the error handling path for APP1JPEG input. The issue is triggered when the application fails to release allocated memory after processing a malformed or specially crafted image file. An attacker can exploit this by inducing a user or automated system to process a malicious APP1JPEG file. Repeated exploitation can lead to resource exhaustion and a denial-of-service (DoS) condition. The vulnerability is addressed in versions 7.1.2-18 and 6.9.13-43.
Affected products
- ImageMagick ImageMagick < 7.1.2-18, < 6.9.13-43
Timeline
- 2026-03-24: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date