Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing image files. A vulnerability in how it handles image metadata (XMP profiles) could allow a specially crafted image to crash the application. This could lead to a service outage or denial-of-service for applications that automatically process user-uploaded images.
Technical details
A heap-use-after-free vulnerability exists in ImageMagick (specifically affecting Magick.NET wrappers) due to a missing null check during the parsing of XMP profiles. An attacker can trigger this by providing a malformed image file with a specifically crafted XMP profile. While the attack complexity is rated as high and the impact is limited to a partial loss of availability (crash), it can be triggered over the network without prior authentication or user interaction. The issue is addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: disclosed: Initial disclosure by dlemstra
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched: Magick.NET 14.15.0 released