Skip to main content

Magick.NET CVE-2026-62363

| EUVDEUVD-2026-50573 MEDIUM
Out-of-bounds Write (CWE-787)
2026-07-24 https://github.com/ImageMagick/ImageMagick GHSA-422r-8c97-xcg4
Buffer Overflow Memory Corruption Red Hat Suse
5.0
CVSS 3.1 · Vendor: https://github.com/ImageMagick/ImageMagick
Share

Severity by source

Vendor (https://github.com/ImageMagick/ImageMagick) PRIMARY
5.0 MEDIUM
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.0 MEDIUM

Local attack needs a low-privileged user to open a malicious file; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.0 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/ImageMagick/ImageMagick).

CVSS VectorVendor: https://github.com/ImageMagick/ImageMagick

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Source Code Evidence Fetched
Jul 26, 2026 - 12:13 vuln.today
Analysis Generated
Jul 26, 2026 - 12:13 vuln.today

DescriptionCVE.org

A heap buffer over-write can occur in the fx operation by passing a crafted argument.

AnalysisAI

A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.

Technical ContextAI

The flaw resides in the fx (special effects) expression parser within ImageMagick, a widely-used image processing library. The root cause is a heap-based buffer over-write (CWE-787) that occurs when the parser mishandles specially crafted operand arguments. This issue is exposed through the Magick.NET NuGet packages (e.g., Magick.NET-Q16-AnyCPU, Magick.NET-Q16-HDRI-x64) which provide .NET bindings to ImageMagick. The attack vector is local: an attacker must supply a malicious file or argument string to a vulnerable Magick.NET-based application.

RemediationAI

Upgrade all affected Magick.NET packages to version 14.15.0 or later. This release integrates the patched ImageMagick library (7.1.2-27) that resolves the fx heap buffer over-write. No workarounds are specified; if upgrading is not immediately possible, consider disabling or restricting the use of the fx operation in user-supplied image processing paths, though this may impact functionality. Patch details are available in the GitHub advisory GHSA-422r-8c97-xcg4 and Magick.NET release notes.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

CVE-2026-62363 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy