Junglewise Threat Intelligence

ImageMagick policy bypass in matrix-backed operations

Severity: low · CVSS 3.3 · Published 2026-07-24

Vendors: ImageMagick.

Executive brief

ImageMagick is a software suite used for creating, editing, and converting images. A vulnerability in certain image processing operations allows the software to bypass security policies and consume more system memory than intended. This could lead to a denial-of-service condition where the application or system becomes unresponsive due to resource exhaustion.

Technical details

A resource consumption vulnerability exists in ImageMagick's matrix-backed operations, such as the '-canny' edge detection operator. The software fails to properly validate memory allocation requests against established security policies during these specific operations. An attacker can exploit this by providing a specially crafted image or command that triggers excessive memory allocation, bypassing configured limits (CWE-770, CWE-400). This is a local attack requiring user interaction, typically involving the processing of a malicious file. The issue is addressed in Magick.NET version 14.15.0.

Affected products

  • ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
  • ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
  • ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
  • ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
  • ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
  • ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
  • ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
  • ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
  • ImageMagick Magick.NET-Q16-arm64 < 14.15.0
  • ImageMagick Magick.NET-Q16-x64 < 14.15.0
  • ImageMagick Magick.NET-Q16-x86 < 14.15.0
  • ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
  • ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
  • ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
  • ImageMagick Magick.NET-Q8-arm64 < 14.15.0
  • ImageMagick Magick.NET-Q8-x64 < 14.15.0
  • ImageMagick Magick.NET-Q8-x86 < 14.15.0

Timeline

  • 2026-06-26: disclosed: Initial disclosure by dlemstra
  • 2026-06-26: patched: Magick.NET 14.15.0 released
  • 2026-07-24: advisory: GitHub Advisory published

References