ImageMagick vulnerabilities

In ImageMagick prior to version 7.1.2-25, a crafted multi-frame file can cause a heap buffer overwrite when encoding with the SF3 encoder. This issue has been fixed in version 7.1.2-25.

In ImageMagick prior to version 7.1.2-25, providing invalid options to the wand option parser causes a small memory leak. This issue has been fixed in version 7.1.2-25.

ImageMagick before versions 6.9.13-50 and 7.1.2-25 has a null pointer dereference vulnerability in the distort operation with incorrect arguments. The issue is fixed in the mentioned versions.

ImageMagick before versions 6.9.13-50 and 7.1.2-25 contains a heap-use-after-free vulnerability in CheckPrimitiveExtent when memory allocation fails, potentially causing a crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the ICON decoder causes an incorrect loop, leading to an out-of-bounds heap write and crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the AcquireAlignedMemory function lacks a check for maximum memory request, potentially leading to an out-of-memory condition.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-24 has a filename parsing flaw that allows bypassing security policy and reading files disallowed by policy using a symlink.

Vulnerability in ImageMagick (versions prior to 6.9.13-48 and 7.1.2-24) in the DCM decoder lacks validation of image dimensions, potentially causing crashes during subsequent operations.

ImageMagick before versions 6.9.13-48 and 7.1.2-24 contains a vulnerability in the MAT decoder on 32-bit systems, where a missing return value check could lead to a heap buffer over-write.

In ImageMagick prior to versions 6.9.13-49 and 7.1.2-24, a crafted MVG file can cause a stack overflow due to a missing depth or visited-set check. This issue has been fixed in versions 6.9.13-49 and 7.1.2-24.

Vulnerability in ImageMagick before versions 6.9.13-49 and 7.1.2-24, causing an infinite loop during subimage-search operation with a crafted image.

A heap buffer over-write vulnerability was found in ImageMagick before version 7.1.2-24 when using the Floyd-Steinberg dithering method with a mask. This can lead to memory corruption.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-read vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache operated without a challenge–response authentication model. This has been changed in newer versions.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contains a race condition vulnerability that allows an attacker connected to the magick -distribute-cache service to hijack a file descriptor in the server process.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-write vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick, a vulnerability was found in JP2 handling where an incorrect check leads to a heap buffer over-write of a single byte when certain options are specified. The issue affects versions prior to 6.9.13-48 and 7.1.2-23.

In ImageMagick, a vulnerability was found in the fx operation where a missing depth check can lead to a stack overflow when a crafted argument is passed. The issue affects versions prior to 7.1.2-23.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out-of-bounds write can occur due to a missing check. This issue has been fixed in versions 6.9.13-48 and 7.1.2-23.

ImageMagick is free and open-source software for image editing. Prior to versions 7.1.2.23 and 6.9.13-48, a crafted MSL image can trigger a heap-use-after-free. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

ImageMagick prior to versions 7.1.2.23 and 6.9.13-48 lacks a check in the MIFF decoder, allowing a crafted file to cause an infinite loop and CPU exhaustion.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

ImageMagick before versions 6.9.13-47 and 7.1.2-22 has a resource exhaustion vulnerability in the MNG coder. Missing check of the image list limit allows reading more images than allowed, leading to excessive resource use.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, performing a polynomial distortion with specific arguments can cause an out-of-bounds over-read of 24 bytes. This issue has been fixed in the mentioned versions.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-22, an invalid connected-components:keep-top value can cause a heap buffer over-read during connected components operation. This has been fixed.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, a missing check in the PSD decoder allows bypassing the list-length resource policy when decoding a PSD image. Other security limits still apply.

In ImageMagick prior to versions 6.9.13-47 and 7.1.2-22, writing an IPTC output file with a malicious input can cause an out-of-bounds read of one byte. This has been fixed.

In ImageMagick versions below 7.1.2-19 and 6.9.13-44, the `DestroyXMLTree()` function frees XML tree memory recursively without depth limit. Processing an XML file with deeply nested structures exhausts stack memory, causing a Denial of Service (DoS).

In ImageMagick below versions 7.1.2-19 and 6.9.13-44, a heap buffer overflow in the MVG decoder can lead to an out-of-bounds write when processing a crafted image.

In ImageMagick prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in the DIB coder can result in out-of-bounds read or write.

In ImageMagick prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This can lead to undefined behavior.

In ImageMagick prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file triggers an attempt to allocate approximately 674 GB of memory, causing an out-of-memory abort.

In ImageMagick prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure, but when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.

ImageMagick prior to versions 7.1.2-15 and 6.9.13-40 has a stack buffer overflow vulnerability when processing an attribute in msl.c. A long value overflows a fixed-size stack buffer, leading to memory corruption.

A vulnerability in ImageMagick allows bypassing path security policies by using unnormalized paths. An attacker can use path traversal to access files that should be blocked by policy rules, leading to local file disclosure (LFI). The issue is fixed in versions 7.1.2-15 and 6.9.13-40.

In ImageMagick prior to version 7.1.2-15, the `WriteUHDRImage` function in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write.

A heap buffer overflow vulnerability was found in ImageMagick's XBM image decoder (ReadXBMImage). An attacker can exploit a crafted image file to write controlled data beyond the allocated heap buffer, causing an overflow. The issue affects versions prior to 7.1.2-13 and 6.9.13-38.

ImageMagick before version 7.1.1-14 crashes when processing a crafted TIFF file. Version 7.1.1-14 fixes the issue.

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a critical integer overflow vulnerability in its ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates image_size = 2 * width * height without checking for overflow.

In ImageMagick, prior to versions 7.1.2-9 and 6.9.13-34, there is a vulnerability in the Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. This leads to memory being freed while leaving a pointer to freed memory, which can result in crashes or heap corruption.

ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes.

ImageMagick versions prior to 7.1.2-7 and 6.9.13-32 contain an integer overflow in the BMP decoder on 32-bit systems. When calculating the extent value (columns × bits per pixel), the multiplication can overflow and wrap to zero, and the overflow check added for CVE-2025-57803 is placed after the overflow occurs. Only 32-bit builds with manually increased resource limits are affected; 64-bit systems and default limits are not vulnerable. Fixed in 7.1.2-7 and 6.9.13-32.

ImageMagick versions lower than 14.8.2 include insecure functions SeekBlob() and WriteBlob() that allow a heap write beyond the allocated memory when the offset is large. The vulnerability does not require external delegates or policy settings. It is fixed in version 14.8.2.

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.

A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. A local attacker may trick the user into opening a specially crafted file, leading to an out-of-bounds read error and potentially causing the application to crash.

A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function. An attacker could trick a user into opening a specially crafted file, triggering a heap-use-after-free write error, causing an application crash and resulting in a denial of service.

A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user into opening a specially crafted file, triggering an out-of-bounds read error, which may cause the application to crash.

A vulnerability was found in ImageMagick that allows shell command injection via video:vsync or video:pixel-format options during video encoding/decoding.

A vulnerability was found in ImageMagick, occurring due to undefined behaviors of casting double to size_t in svg, mvg and other coders. This is a recurring bug related to CVE-2022-32546.