Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting digital images. A flaw in how it handles memory during image processing could allow an attacker to crash the application by providing a specially crafted image file. This could lead to a service outage for websites or applications that use ImageMagick to process user-uploaded content.
Technical details
A heap use-after-free vulnerability exists in ImageMagick's meta coder. The issue occurs when a memory allocation fails, leading to a single-byte write to a stale pointer. An attacker can exploit this by submitting a specially crafted image file for processing. While the attack complexity is high and the impact is limited to a denial of service (DoS) via application crash, it can be triggered remotely without user interaction. The vulnerability is addressed in versions 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick < 7.1.2-15, < 6.9.13-40
Timeline
- 2026-02-23: advisory: Initial GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD