ImageMagick EUVD-2026-36189

| CVE-2026-53462 MEDIUM

Use After Free (CWE-416)

2026-06-10 GitHub_M

GHSA-px7q-ggqj-hcf2

Denial Of Service Use After Free Memory Corruption Imagemagick

5.9

CVSS 3.1 · Vendor: GitHub_M

Share

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AV:N reflects network-accessible image intake; AC:H because triggering an allocation failure at the specific CheckPrimitiveExtent site requires crafted input; impact is availability-only with no confidentiality or integrity consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat

3.7 LOW

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

2

Patch available

Jun 26, 2026 - 18:02 EUVD

Analysis Generated

Jun 10, 2026 - 22:55 vuln.today

DescriptionCVE.org

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, when an allocation fails in CheckPrimitiveExtent this can result in a heap-use-after-free and result in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

AnalysisAI

Heap-use-after-free in ImageMagick's CheckPrimitiveExtent function allows remote attackers to crash the image processing service by supplying crafted input that triggers a memory allocation failure, resulting in a denial-of-service condition. Affected are all releases of the 6.x branch prior to 6.9.13-50 and all 7.x releases prior to 7.1.2-25. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the network-accessible attack vector is relevant wherever ImageMagick processes untrusted images (e.g., web upload pipelines, CI/CD asset processors).

Technical ContextAI

ImageMagick (CPE: cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*) is a widely deployed open-source image manipulation library used in countless web applications, content management systems, and automated pipelines. The vulnerable code path resides in CheckPrimitiveExtent, a function responsible for validating or extending memory buffers used during primitive drawing or rendering operations. CWE-416 (Use After Free) is the root cause: when an internal memory allocation call inside CheckPrimitiveExtent fails - for example, due to resource exhaustion or an exceptionally large image operand - error-handling logic does not properly guard subsequent accesses, leaving a dangling pointer to freed heap memory. A subsequent read or write through that pointer causes undefined behavior, manifesting as a process crash. This class of bug is particularly dangerous in image-processing code because image dimensions, palette sizes, and drawing primitives are attacker-controlled inputs that can be tuned to force allocation failures deterministically.

RemediationAI

The vendor-released patch is available in ImageMagick versions 6.9.13-50 (legacy 6.x branch) and 7.1.2-25 (current 7.x branch). Operators should upgrade to one of these versions as the primary remediation; the fix addresses the missing null-check or error-handling guard after the failed allocation in CheckPrimitiveExtent. Full advisory details are at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2. If immediate upgrade is not possible, the most effective compensating control is to restrict which users or services can submit images to ImageMagick-backed endpoints - moving untrusted input processing behind authentication reduces the attacker-accessible attack surface. Additionally, enforcing per-request resource limits via ImageMagick's policy.xml (e.g., capping memory allocation with '<policy domain="resource" name="memory" value="256MiB"/>') can reduce the likelihood of triggering allocation failure conditions, though this is not a complete fix and carries the trade-off of rejecting legitimately large images.

More in Imagemagick

View all

CVE-2016-3714 HIGH Act Now POC

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.

CVE-2016-3718 MEDIUM Act Now POC

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

CVE-2016-3715 MEDIUM Act Now POC

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi

CVE-2017-15277 MEDIUM This Month POC

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc

CVE-2016-5841 CRITICAL Act Now POC

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv

CVE-2016-3717 MEDIUM This Month POC

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi

CVE-2016-5118 CRITICAL Emergency

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit

CVE-2016-5689 CRITICAL Act Now POC

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b

CVE-2016-5690 CRITICAL Act Now POC

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL Act Now POC

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b

CVE-2017-14138 CRITICAL Act Now POC

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer

CVE-2026-23876 CRITICAL Act Now POC

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Not-Affected

Share

EUVD-2026-36189 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy