Executive brief
ImageMagick is a widely used open-source tool for editing and processing digital images. A flaw in how it handles certain image files could allow an attacker to read sensitive information from the computer's memory. This occurs when the software processes a specially crafted image, potentially leading to the exposure of data that should remain private.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in ImageMagick's BGR decoder. The root cause is a failure to perform adequate end-of-file (EOF) checks at all necessary locations during the decoding process. An attacker can exploit this by providing a specially crafted image file, which triggers a heap buffer over-read when processed. This can be achieved remotely without authentication or user interaction. Successful exploitation allows for the unauthorized disclosure of small amounts of memory contents. The issue is resolved in version 7.1.2-27.
Affected products
- ImageMagick ImageMagick < 7.1.2-27
Timeline
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-29: disclosed: CVE published to NVD
- 2026-07-29: patched: Fix confirmed in version 7.1.2-27