Executive brief
ImageMagick is a widely used open-source tool for creating, editing, and converting digital images. A flaw in how it handles specific image files (JNX format) on 32-bit systems could allow a specially crafted file to crash the application. This could lead to service disruptions for organizations that use ImageMagick to process user-uploaded images or automate media workflows.
Technical details
An integer overflow vulnerability (CWE-190) exists in the JNX decoder of ImageMagick when running on 32-bit architectures. The flaw is triggered when the application processes an exceptionally large JNX image file, leading to a heap buffer overwrite. While the attack vector is local and requires high complexity to exploit, it can result in a denial-of-service (DoS) condition by crashing the process. The issue is specific to 32-bit builds and has been addressed in versions 6.9.13-52 and 7.1.2-27.
Affected products
- ImageMagick ImageMagick < 6.9.13-52, < 7.1.2-27 (32-bit builds only)
Timeline
- 2026-07-15: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: NVD publication date