Executive brief
ImageMagick is a software suite used for creating, editing, and converting images. A vulnerability in certain image processing operations allows the software to bypass security policies and consume more system memory than intended. This could lead to a denial-of-service condition where the application or system becomes unresponsive due to resource exhaustion.
Technical details
A resource consumption vulnerability exists in ImageMagick's matrix-backed operations, such as the '-canny' edge detection operator. The software fails to properly validate memory allocation requests against established security policies during these specific operations. An attacker can exploit this by providing a specially crafted image or command that triggers excessive memory allocation, bypassing configured limits (CWE-770, CWE-400). This is a local attack requiring user interaction, typically involving the processing of a malicious file. The issue is addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: disclosed: Initial disclosure by dlemstra
- 2026-06-26: patched: Magick.NET 14.15.0 released
- 2026-07-24: advisory: GitHub Advisory published