Executive brief
ImageMagick is widely used image processing software deployed across web servers, graphics applications, and content management systems. A heap use-after-free vulnerability in the meta coder can be triggered by processing specially crafted image files, allowing remote attackers to cause service crashes and denial of service without authentication or user interaction.
Technical details
The vulnerability is a heap use-after-free (CWE-416) in ImageMagick's meta coder that occurs when memory allocation fails during image processing. Under this error condition, a single byte is written to a stale pointer, corrupting heap state. Remote attackers can trigger the flaw by submitting specially crafted image files to systems running ImageMagick (versions before 7.1.2-15 or 6.9.13-40). The attack requires no privileges or user interaction and is reachable over the network with high complexity. Successful exploitation results in denial of service (application crash), with no confidentiality or integrity impact. Patches are available in ImageMagick 7.1.2-15 and 6.9.13-40.
Affected products
- ImageMagick ImageMagick before 7.1.2-15 and before 6.9.13-40
- dlemstra Magick.NET-Q16-AnyCPU before 14.10.3
Timeline
- 2026-02-23: disclosed: Original advisory published as GHSA-2gq3-ww97-wfjm
- 2026-06-23: other: Duplicate advisory GHSA-8g9f-ccmr-vfvg published
- 2026-09-24: other: Duplicate advisory withdrawn; references to original advisory preserved