Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: imagemagick fixed in 7.1.2.12-r0
AnalysisAI
ImageMagick received a security fix in Alpine Linux package version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing software. The vulnerability details - including attack vector, impact, and root cause - have not been publicly disclosed by the reporter (Alpine Linux vendor). With an EPSS score of 0.05% (15th percentile), exploitation probability is currently very low, and no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
ImageMagick is a widely-used open-source image processing toolkit capable of reading, converting, and manipulating hundreds of image formats. Historically, ImageMagick has been affected by a broad range of vulnerability classes including memory corruption, out-of-bounds reads/writes, heap overflows, and server-side request forgery (ImageMagick 'ImageTragick' class issues), due to its complex format parsing logic. The affected package here is the Alpine Linux distribution packaging of ImageMagick, fixed in the Alpine package release 7.1.2.12-r0. No CPE string, CWE classification, or CVSS vector was provided, making it impossible to confirm the specific subsystem or root cause class from available data.
Affected ProductsAI
ImageMagick as packaged by Alpine Linux is confirmed affected, with the fix delivered in Alpine package version 7.1.2.12-r0. The specific upstream ImageMagick version range affected, and whether other Linux distributions or platform packages are impacted, is not determinable from available data. No CPE string was provided to narrow the affected scope further. Users of ImageMagick on Alpine Linux running package versions prior to 7.1.2.12-r0 should treat this as potentially affected.
RemediationAI
Update the Alpine Linux ImageMagick package to version 7.1.2.12-r0 or later using the standard Alpine package manager: 'apk upgrade imagemagick'. This is the vendor-confirmed fix per the Alpine Linux advisory. No upstream ImageMagick patch version was independently confirmed from available data, and no workarounds have been identified. If an immediate upgrade is not feasible and ImageMagick is exposed to untrusted input (e.g., user-uploaded images in a web application), consider restricting file format processing to only required types via ImageMagick's policy.xml, disabling processing of high-risk formats (PS, EPS, PDF, SVG) as a compensating control, or sandboxing ImageMagick processes with restricted filesystem and network access. These controls reduce exposure but do not eliminate the underlying vulnerability.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today