Executive brief
ImageMagick is a software suite used for image processing and conversion. A vulnerability in how it handles specific image mathematical kernels could allow an attacker to cause the application to crash by providing a specially crafted input. This primarily impacts the availability of services that automate image processing.
Technical details
An integer overflow vulnerability exists in ImageMagick's binomial kernel processing. When a user supplies a large binomial kernel, an overflow occurs during calculation, subsequently leading to a division by zero error. This is a local vulnerability that requires user interaction (e.g., processing a malicious file). Successful exploitation results in a denial-of-service (crash) of the affected process. The issue is addressed in Magick.NET version 14.12.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-x86 < 14.12.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-x86 < 14.12.0
Timeline
- 2026-05-16: disclosed: Initial disclosure by reporter 007bsd
- 2026-05-21: advisory: GitHub Advisory GHSA-vf33-6r7x-66xx published
- 2026-05-21: patched: Magick.NET 14.12.0 released