Executive brief
ImageMagick is a widely used open-source tool for editing and converting digital images. A security flaw has been identified where a specially crafted image or command argument can cause the software to crash or behave unexpectedly. This could lead to a denial-of-service, potentially disrupting automated image processing workflows or applications that rely on this library.
Technical details
A heap-based buffer overflow (CWE-787) exists in ImageMagick's 'fx' operation. The vulnerability is triggered when the software processes a specially crafted argument, leading to an out-of-bounds write on the heap. Exploitation requires a local attacker with low privileges and some degree of user interaction (e.g., convincing a user to process a malicious file). The primary impact is on system availability, potentially causing a crash (DoS). The issue is resolved in version 7.1.2-27.
Affected products
- ImageMagick ImageMagick < 7.1.2-27
Timeline
- 2026-07-14: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: NVD publication date
- 2026-07-29: patched: Fix confirmed in version 7.1.2-27