EUVD-2026-42259
GHSA-m366-rhm3-cx89
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges and precise allocation-failure timing required; impacts limited to partial heap read and minor availability disruption with no integrity effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.
AnalysisAI
Heap-buffer-overflow read in ImageMagick's GetPixelIndex function exposes limited heap memory contents and can cause partial availability impact in affected 6.x and 7.x branches before the patched releases. The root cause is a metadata-allocation race in OpenPixelCache, which updates image channel metadata before confirming successful pixel cache memory allocation, leaving GetPixelIndex to operate on stale channel counts. Exploitation requires high privilege access and the ability to induce memory or disk allocation failures, yielding only limited confidentiality and availability impact; no public exploit code and no CISA KEV listing are associated with this CVE.
Technical ContextAI
ImageMagick is an open-source image processing library and CLI toolkit used heavily in web platforms, CMS pipelines, and cloud media services. The vulnerability resides in the pixel cache subsystem: OpenPixelCache is responsible for allocating the backing store (memory or disk) for image pixels, and it also updates internal channel metadata structures. CWE-125 (Out-of-bounds Read) applies because the metadata - including channel counts that GetPixelIndex uses to compute array offsets - is written before the allocation is confirmed to have succeeded. When an attacker can force allocation failure (e.g., by exhausting system memory or disk quota), GetPixelIndex reads using the already-updated (but now inconsistent) metadata against uninitialized or partially allocated memory, yielding an out-of-bounds heap read. Affected CPE targets both the legacy ImageMagick 6.x branch (prior to 6.9.13-40) and the current 7.x branch (prior to 7.1.2-15).
RemediationAI
Upgrade ImageMagick to version 7.1.2-15 or later on the 7.x branch, or to version 6.9.13-40 or later on the legacy 6.x branch. Patch details and the upstream security advisory are available at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77. If an immediate upgrade is not feasible, the realistic risk is substantially reduced by the PR:H requirement - restricting who can submit images to the processing pipeline and enforcing resource quotas (ulimit on memory and disk) limits an attacker's ability to induce the allocation failure that triggers the condition. Disabling image writers that call GetPixelIndex (format-specific writers) is a more aggressive workaround but may disrupt legitimate functionality. No side effects of the patch are noted by the vendor.
More in Imagemagick
View allReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today