Executive brief
ImageMagick is an open-source image manipulation library widely used in web applications and servers to process images. A policy bypass vulnerability in its PCD, CUBE, and HALD decoders allows a local attacker who can supply command-line options to bypass memory resource limits, potentially causing denial of service through memory exhaustion. This impacts system availability but does not expose or corrupt data.
Technical details
The vulnerability is a resource limit bypass (CWE-400, CWE-770) in the PCD, CUBE, and HALD image decoders. When specific command-line options are provided, the affected decoders fail to enforce configured memory resource policies, allowing unchecked memory allocation. The attack requires local access and the ability to pass command-line arguments to ImageMagick, resulting in denial of service through memory exhaustion with limited availability impact. The issue is patched in ImageMagick 7.1.2-31 and 6.9.13-56.
Affected products
- ImageMagick ImageMagick before 7.1.2-31 and before 6.9.13-56
Timeline
- 2026-09-18: disclosed: GitHub Security Advisory published
- 2026-09-18: patched: Fixed in versions 7.1.2-31 and 6.9.13-56