Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in its PDB (Palm Database) file decoder could allow a specially crafted file to cause the application to crash or behave unexpectedly. This could lead to a temporary service outage for applications that automatically process user-uploaded images.
Technical details
A use-after-free (UAF) vulnerability exists in the PDB decoder of ImageMagick. The flaw is triggered when a memory allocation fails, causing the decoder to utilize a stale pointer. An attacker can exploit this by providing a malicious PDB file for processing, which may result in a denial-of-service (crash) or a single zero-byte write to freed memory. The attack vector is network-based but requires high complexity to successfully trigger the specific memory failure condition. The issue is resolved in versions 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40
Timeline
- 2026-02-23: advisory: Initial GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD