Executive brief
ImageMagick is a widely used software suite for processing and converting images. A vulnerability in its JSON and YAML encoders could allow a local attacker to cause a system crash or service instability. This issue stems from an incomplete previous security fix and primarily impacts the availability of applications using the library.
Technical details
An off-by-one error (CWE-193) exists in the JSON and YAML encoders of ImageMagick. This vulnerability is the result of an incorrect fix for a previous security issue (GHSA-5592-p365-24xh), leading to a single-byte heap buffer overwrite. A local attacker can exploit this flaw without any special privileges or user interaction. The primary impact is on system availability (Denial of Service), as indicated by the CVSS score. The issue is addressed in Magick.NET version 14.12.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-arm64 < 14.12.0
- ImageMagick Magick.NET-Q16-x64 < 14.12.0
- ImageMagick Magick.NET-Q16-x86 < 14.12.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-arm64 < 14.12.0
- ImageMagick Magick.NET-Q8-x64 < 14.12.0
- ImageMagick Magick.NET-Q8-x86 < 14.12.0
Timeline
- 2026-05-16: disclosed: Initial report to ImageMagick/ImageMagick
- 2026-05-21: advisory: GitHub Advisory published
- 2026-05-21: patched: Fix released in version 14.12.0