Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability has been identified where processing a specially crafted image with an invalid magnification method can cause the application to crash. This could lead to a temporary service outage or application instability if a user is tricked into processing a malicious file.
Technical details
A heap-based buffer overflow (out-of-bounds read) exists in ImageMagick's magnify operation. The vulnerability is triggered when the software processes an image containing an unrecognized 'magnify:method' value, leading to a 4-byte read beyond the allocated buffer as identified by AddressSanitizer. The attack requires local access and user interaction (processing a malicious image). While primarily impacting availability (DoS), it is rated as low severity. The issue is addressed in Magick.NET version 14.12.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-x86 < 14.12.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-x86 < 14.12.0
Timeline
- 2026-04-13: disclosed
- 2026-04-14: advisory: GHSA-8vfj-q2cp-5m5j published