Executive brief
ImageMagick is a widely-used open-source library for manipulating and displaying images. A vulnerability in the UHDR encoder allows attackers to bypass resource allocation policies by processing specially crafted image files, potentially causing the application to consume excessive memory and become unavailable. Organizations relying on ImageMagick for image processing should update to patched versions to prevent denial-of-service attacks.
Technical details
The vulnerability is a policy bypass (CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits) in ImageMagick's UHDR encoder. The encoder fails to perform policy checks when allocating buffers for image pixel data, allowing an attacker to circumvent configured resource limits. An attacker can craft a malicious UHDR image file and supply it to an application using ImageMagick; no authentication or user interaction is required, though the attack has high complexity. Exploitation results in denial of service through excessive memory allocation. The vulnerability has been patched in ImageMagick 7.1.2-31 and later versions.
Affected products
- ImageMagick ImageMagick before 7.1.2-31
Timeline
- 2026-09-03: disclosed: GitHub Security Advisory GHSA-7hjx-392p-f8cm published
- 2026-09-03: patched: Patch released in version 7.1.2-31