Executive brief
ImageMagick is a widely used software suite for displaying, converting, and editing raster image files. A flaw in how it handles ICON files can lead to a memory leak if a specific internal memory allocation fails. Over time, this could consume system resources and potentially lead to minor service degradations or crashes in applications that process many untrusted images.
Technical details
A memory leak (CWE-401) was identified in the ICON decoder component of ImageMagick. The vulnerability is triggered when an internal memory allocation fails, but previously allocated resources are not properly released. While the attack complexity is high and the impact is limited to a minor reduction in availability, it can be triggered remotely via the network if an application processes maliciously crafted or extremely large ICON files. The issue is addressed in ImageMagick versions 7.1.2-26 and 6.9.13-51, as well as Magick.NET 14.15.0.
Affected products
- ImageMagick ImageMagick < 7.1.2-26, < 6.9.13-51
- dlemstra Magick.NET < 14.15.0
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: Initial patch release for ImageMagick core
- 2026-07-12: patched: Magick.NET wrapper updated to 14.15.0
- 2026-07-24: advisory