Executive brief
ImageMagick is a software suite used for displaying, converting, and editing image files. A minor security issue exists where a single byte of memory can be leaked when the software is configured to print image profile information in debug mode. This poses a very low risk of exposing sensitive information and typically requires specific local configurations to exploit.
Technical details
An off-by-one error (CWE-193) leading to an out-of-bounds read (CWE-125) exists in ImageMagick's profile printing logic. When using the 'identify' command to display image profiles, if the profile contains non-printable characters and debug mode is enabled, the application may read and print one additional byte from memory beyond the intended buffer. This is a local attack with high complexity, as it requires specific environmental conditions and debug settings to be active. The vulnerability has been addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched: Magick.NET 14.15.0 released