Executive brief
ImageMagick, a widely used tool for editing and processing digital images, is vulnerable to a memory corruption issue. By providing a specially crafted image processing instruction (an invalid kernel), an attacker could cause the application to crash. This could lead to a denial-of-service, impacting the availability of automated image processing workflows or web services that rely on this software.
Technical details
A heap buffer overwrite vulnerability exists in ImageMagick's morphology operation component. The flaw is triggered by an integer overflow (CWE-190) when processing an invalid user-supplied kernel, leading to a memory corruption event. Exploitation requires a local attacker to provide a malicious kernel and typically involves user interaction (e.g., a user opening a crafted file or a service processing a specific request). Successful exploitation results in a crash (Denial of Service), though the CVSS assessment indicates no impact on confidentiality or integrity. The issue is resolved in versions 6.9.13-51 and 7.1.2-26.
Affected products
- ImageMagick ImageMagick < 6.9.13-51, >= 7.0.1-0 < 7.1.2-26
Timeline
- 2026-07-14: advisory: GitHub advisory published by maintainers
- 2026-07-29: disclosed: NVD publication date
- 2026-07-29: patched: Fixes confirmed in versions 6.9.13-51 and 7.1.2-26