EUVD-2026-36184
GHSA-8pj9-6897-74xc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify image-upload endpoint backed by ImageMagick
-
DeliveryCraft malformed image triggering CWE-20 path
-
ExploitSubmit image via HTTP upload
-
ExecutionImageMagick worker exhausts resources or crashes
-
ImpactConversion pipeline unavailable to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the target system to run an Alpine imagemagick build earlier than 7.1.2.24-r0 and to expose ImageMagick to attacker-controlled image input - typically an HTTP endpoint that accepts uploads and invokes convert/identify/MagickWand, or a backend job that fetches and processes remote images. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed beyond reachability of an ImageMagick-backed processing path. Exploitation is limited where the deployment hardens policy.xml to disable unneeded coders, enforces strict resource ceilings, or sandboxes conversion workers, since those measures contain the availability impact even on an unpatched binary. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High) and indicates a network-reachable, low-complexity, unauthenticated availability-only impact - consistent with a DoS via crafted image upload. The 'Information Disclosure' tag supplied with the report conflicts with the CVSS impact metrics (C:N/I:N/A:H), so the tag is likely a mislabel from the intake source and the CVSS-stated availability impact should be trusted. EPSS, KEV, POC and SSVC data are not present in the provided intelligence, so exploitation likelihood beyond the CVSS signal cannot be quantified; given ImageMagick's huge attack surface in user-upload pipelines, network reachability with no auth makes this worth prioritizing on any internet-facing service that processes user-supplied images, even though it is availability-only and not RCE. |
| Exploit ScenarioDerived | An attacker uploads a maliciously crafted image to any public-facing endpoint that hands the file off to ImageMagick for thumbnailing, conversion, or metadata extraction (avatars, document uploads, CMS media libraries). When ImageMagick parses the file it hits the input-validation defect and consumes excessive resources or crashes the worker, taking the conversion pipeline offline; repeated submissions degrade or deny the service to legitimate users. No public proof-of-concept is referenced in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 10, 2026
Denial of service in ImageMagick affects Alpine Linux package versions prior to 7.1.2.24-r0, where improper input validation allows remote attackers to trigger high availability impact without authentication or user interaction. The flaw is tracked under upstream advisory GHSA-8pj9-6897-74xc and was disclosed via Alpine's security tracking. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Denial of service in ImageMagick versions prior to 7.1.2.24-r0 (as packaged in Alpine Linux) allows remote attackers to crash the image processing engine through improperly validated input. The flaw stems from a CWE-20 input validation weakness and carries a CVSS 7.5 (High) score with availability-only impact and no public exploit identified at time of analysis. Because ImageMagick is widely embedded in web upload pipelines and document/image conversion services, the network-reachable attack surface is significant despite no confidentiality or integrity impact.
ImageMagick on Alpine Linux received a security fix in package version 7.1.2.24-r0, addressing an unspecified vulnerability. The nature of the flaw, affected functionality, and attacker impact are not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirms a fix was issued. No CVSS score, CWE classification, or exploit information is available at time of analysis.
RemediationAI
Upgrade the Alpine imagemagick package to 7.1.2.24-r0 or later using apk (for example, apk update && apk upgrade imagemagick), which is the vendor-released patch for Alpine. Operators running ImageMagick on non-Alpine systems should apply the upstream fix referenced in GHSA-8pj9-6897-74xc (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc) once their distribution ships it. Until patching is complete, compensating controls include restricting which image formats are accepted (use ImageMagick's policy.xml to disable rarely needed coders such as MVG, MSL, EPHEMERAL, and any format not required by your workflow), enforcing strict file-size and resource limits in policy.xml (memory, map, disk, time, width, height) so a malformed image cannot exhaust the worker, and running ImageMagick conversions in an isolated, resource-capped sandbox or queue worker so a crash or hang affects only the worker and not the front-end service - the trade-off is that tighter coder/policy restrictions may break legitimate uploads in formats users rely on.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ImageMagick is a widely-used open-source image processing suite supporting over 200 file formats, often invoked as a backend library by web applications, CMS platforms, and document pipelines for thumbnailing, conversion, and rendering. The root cause is classified as CWE-20 (Improper Input Validation), a class of bug where the parser fails to properly sanity-check attacker-controlled image data before processing it, typically triggering an unhandled error path, infinite loop, or excessive resource consumption inside one of ImageMagick's many codec/coder modules. This advisory is published against the Alpine Linux packaged build of ImageMagick, but the underlying defect lives in the upstream ImageMagick codebase tracked under GHSA-8pj9-6897-74xc.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable image processing with no auth or interaction; CWE-20 in a parser typically yields availability-only impact (crash/resource exhaustion), so C:N/I:N/A:H.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
2DescriptionCVE.org
Alpine Linux: imagemagick fixed in 7.1.2.24-r0
Executive ViewAI
A denial-of-service vulnerability in ImageMagick (Alpine Linux package versions prior to 7.1.2.24-r0) allows remote attackers to trigger service unavailability through improper input validation. Organizations running affected versions face potential operational disruption, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to image processing services, (2) implement input validation and anomaly detection for image file processing, (3) deploy rate limiting on image upload and processing endpoints, (4) isolate ImageMagick in restricted containers with resource limits, (5) monitor logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB