EUVD-2026-97715
GHSA-h82h-8q6v-f57g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUpload crafted WBINFO image to decoder
-
ExploitInduce memory allocation failure during decode
-
ExecutionTrigger use-after-free of freed buffer
-
ImpactCrash application (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Double free prevention
|
| Exploitation Conditions | Exploitation requires the target to process an attacker-supplied crafted image through ImageMagick's WBINFO (Amiga icon/NewIcons) decoder, AND a memory allocation to fail during that decode - the use-after-free in ReadToolTypesNewIcons only occurs under memory-allocation-failure conditions. This allocation-failure prerequisite (reflected as AT:P in the CVSS 4.0 vector) is the primary limiting factor: an attacker cannot reliably force it remotely without the system already being under memory pressure, making consistent triggering difficult. No authentication is required (PR:N) and no user interaction is needed (UI:N) where images are auto-decoded, but only ImageMagick builds in the 7.1.2-30 to pre-7.1.2-32 range with the WBINFO coder reachable are affected. |
| Impact | This is a moderate-severity denial-of-service issue, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) shows a network-reachable, unauthenticated flaw, but impact is limited to availability only (VC:N/VI:N/VA:L) - a crash, not code execution or data exposure, consistent with the CWE-415 use-after-free and the 'crashing the application' description. The single most important signal is AT:P (attack requirements present): the use-after-free only manifests 'when a memory allocation fails during image decoding,' meaning an attacker cannot deterministically trigger it on demand and must rely on the target being under memory pressure. No EPSS score was provided, there is no CISA KEV listing, and no public exploit (POC) was supplied - only vendor patch commits, which are remediation evidence, not weaponization. Signals are internally consistent (network DoS, low impact, conditional trigger) with no contradictions, so the overall picture is a real but low-urgency availability bug that should be patched in routine cycles rather than as an incident. |
| Exploit ScenarioDerived | An attacker submits a specially crafted Amiga-icon/WBINFO image to a service that uses ImageMagick for automatic image decoding (e.g., an upload or thumbnailing pipeline). If a memory allocation fails mid-decode, freed memory in the WBINFO decoder is reused, crashing the worker or application and causing a denial of service. No public exploit code was provided, and reliable triggering depends on inducing allocation-failure conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Denial of service in ImageMagick 7.1.2-30 and 7.1.2-31: a crafted image handled by the WBINFO (Amiga icon) decoder can corrupt memory through a use-after-free - classified in the CVE record as CWE-415 - and crash the process, but only when a memory allocation fails during that decode. The allocation-failure prerequisite (AT:P in the CVSS 4.0 vector) is the main limiter, since a remote attacker cannot reliably force the condition without the target already being under memory pressure, although no authentication (PR:N) and no user interaction (UI:N) are required where images are decoded automatically. No public exploit code and no CISA KEV listing were identified at time of analysis, and vendor patches are available.
RemediationAI
Vendor-released patch: upgrade to ImageMagick 7.1.2-32 or later, per GHSA-vxwm-jfjc-3r4x; the fixes are the upstream commits 48c49d0cc2b72970b762e0d3263f6c35ab35a7b4 and 2ed1b96b9bc71434f0c4e82e3c63fec029c684c6, which null out the freed string-list pointers in MagickCore/string.c and coders/wbinfo.c. If immediate upgrade is not possible, disable the WBINFO coder through an ImageMagick policy.xml entry such as <policy domain="coder" rights="none" pattern="WBINFO"/> - the trade-off is that Amiga icon files can no longer be decoded by that installation, and the policy must be deployed in every configuration file the process reads. Because triggering requires an allocation failure, tightening memory resource limits (MAGICK_MEMORY_LIMIT, MAGICK_MAP_LIMIT, MAGICK_AREA_LIMIT) is counterproductive here: it makes the failing path more likely to be reached, so running the decoder with adequate memory headroom reduces (but does not eliminate) exposure. As a containment measure, decode untrusted images in an isolated, low-privilege worker process or container with seccomp/AppArmor confined so that a crash cannot take down the parent service, and restrict which untrusted inputs reach the WBINFO decoder. Monitor the vendor advisory and the referenced VulnCheck advisory for any revision to affected version ranges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in ImageMagick's WBINFO coder (coders/wbinfo.c), which parses Amiga Workbench icon/NewIcons files and their embedded ToolTypes chunk lists, together with the string-list helper StringToStrings in MagickCore/string.c. During error and cleanup handling in ReadToolTypesNewIcons, previously allocated string-list entries (im1_lines, im2_lines and the textlist elements) were released with DestroyString without the owning pointers being reset, so a later cleanup path could dereference and free already-released memory - the memory-safety class captured as CWE-415 in the CVE data and described as a use-after-free. The vulnerability is only reached on a memory-allocation-failure path during decode, which is why the CVSS 4.0 vector carries AT:P (attack requirements present) even though the network vector is remote and no privileges or user interaction are needed. The upstream fix confirms the root cause: the patch replaces DestroyString(textlist[i]) with a NULL assignment in string.c and explicitly nulls im1_lines and im2_lines after freeing in wbinfo.c, preventing the stale pointers from being reused. Affected builds are identified by CPE cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* where the WBINFO coder is reachable.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable crafted image with no auth or interaction, but AC:H because the use-after-free only triggers under memory allocation failure; impact is availability-only (A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB