Executive brief
ImageMagick is a software suite used to create, edit, and convert images. A vulnerability exists where the software may crash or behave unpredictably when it runs out of memory while processing image captions. This could lead to a minor service disruption if an attacker provides a specially crafted image that triggers this memory error.
Technical details
A use-after-free vulnerability exists in ImageMagick's FormatMagickCaption method. The flaw is triggered when a memory allocation fails, leaving a dangling pointer that continues to reference the freed memory location. This is reachable via the network with high attack complexity, as it requires specific memory exhaustion conditions to be met during caption formatting. An attacker could potentially cause a denial-of-service (crash). The issue is addressed in Magick.NET version 14.15.0.
Affected products
- ImageMagick Magick.NET-Q16-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-HDRI-x86 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q16-arm64 < 14.15.0
- ImageMagick Magick.NET-Q16-x64 < 14.15.0
- ImageMagick,versions: Magick.NET-Q16-x86 < 14.15.0
- ImageMagick Magick.NET-Q8-AnyCPU < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-OpenMP-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-arm64 < 14.15.0
- ImageMagick Magick.NET-Q8-x64 < 14.15.0
- ImageMagick Magick.NET-Q8-x86 < 14.15.0
Timeline
- 2026-06-26: disclosed: Initial disclosure by dlemstra
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched: Magick.NET 14.15.0 released