Executive brief
ImageMagick is a widely used software suite for editing and converting digital images. A minor security flaw was discovered where the software might inadvertently reveal a single byte of internal memory when processing certain image files while in debug mode. This could potentially lead to a very limited leak of information, though the practical risk to business operations and data is considered low.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in ImageMagick's 'identify' command due to an off-by-one error (CWE-193) when handling non-printable profile values. When debug output is enabled, the application may read and print a single byte beyond the allocated profile buffer. The attack vector is local and requires high complexity to exploit effectively, as it only leaks a single byte under specific debugging conditions. The issue is resolved in versions 7.1.2-26 and 6.9.13-51.
Affected products
- ImageMagick ImageMagick < 7.1.2-26
- ImageMagick ImageMagick < 6.9.13-51
Timeline
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date