Executive brief
ImageMagick, a widely used software suite for displaying and editing images, is affected by a memory handling flaw. An attacker could provide a specially crafted image or command that uses an invalid magnification method, potentially causing the application to crash or leak small amounts of memory. This could lead to a temporary disruption of services that process user-uploaded images.
Technical details
A heap-based buffer overflow (out-of-bounds read) exists in ImageMagick's magnify operation. The vulnerability is triggered when the software encounters an unrecognized 'magnify:method' value, leading to a read of size 4 beyond the allocated heap buffer. The attack vector is local and requires user interaction, such as a user being tricked into processing a malicious image file. Successful exploitation can result in a denial of service (application crash) or potential exposure of sensitive memory contents. The issue is addressed in version 7.1.2-19.
Affected products
- ImageMagick ImageMagick < 7.1.2-19
Timeline
- 2026-04-13: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date
- 2026-07-11: patched: Fix confirmed in version 7.1.2-19