EUVD-2026-97712
GHSA-5w2q-9xw9-jg4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted CMYK image to service
-
ExploitApplication writes PDF with JPEG2000 compression
-
ExecutionUse-after-free triggered in pdf.c WritePDFImage
-
ImpactImageMagick process crashes (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to use ImageMagick to WRITE a PDF with JPEG2000 compression applied to a CMYK-colorspace image - the vulnerable code path is in the PDF writer's handling of CMYK images under JPEG2000Compression. The attacker supplies the crafted CMYK image, but the trigger is the PDF write operation with JPEG2000 compression, which is a non-default output mode controlled by the operator/application rather than by the attacker. Merely decoding or reading the attacker's image does NOT trigger the bug; the limiting factor is that the deployment must actually perform CMYK-to-PDF conversion with JPEG2000 compression, which sharply narrows the realistic exposed population despite the network attack vector. |
| Impact | This is a moderate-risk availability issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with base score 6.3 shows network reach and no required privileges or user interaction, but the AT:P flag (attack requirements present) and the single Low availability impact (VC:N/VI:N/VA:L) correctly signal that the real-world outcome is a process crash, not compromise. The description confirms this: it says the freed memory is reused 'potentially crashing the process' - there is no vendor or NVD claim of code execution despite the CWE-416 use-after-free classification, so treating this as RCE would overstate it. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no signal of active or widespread exploitation - consistent with a DoS-only, config-dependent bug reported by a research vendor (VulnCheck) rather than observed in attacks. The key caveat: AT:P reflects that exploitation depends on the victim application being configured to write PDFs with JPEG2000 compression, which the raw 6.3 score does not make obvious - defenders should weigh that precondition heavily. |
| Exploit ScenarioDerived | An application that uses ImageMagick to convert user-supplied images into PDFs with JPEG2000 compression receives a crafted CMYK image from an attacker. When ImageMagick writes that image to PDF, freed memory in the PDF coder is reused, crashing the worker process and causing a denial of service for that conversion pipeline. No public exploit code was identified in the provided data, and the impact is limited to a crash rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Use-after-free in ImageMagick's PDF writer (coders/pdf.c) can crash the process when a CMYK-colorspace image is written to PDF using JPEG2000 compression; affected releases are ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32. The attacker supplies the crafted CMYK image, but the trigger is the operator-side PDF export operation with JPEG2000 compression selected, which is not the default output mode - reading or decoding the image alone does not reach the vulnerable code path. The issue is a low-impact availability defect (no confidentiality or integrity loss), unauthenticated per the CVSS PR:N vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor patches exist as commits in the ImageMagick and ImageMagick6 repositories.
RemediationAI
Vendor-released patch: upgrade to ImageMagick 6.9.13-57 or 7.1.2-32 (or later) - the fixes are the upstream commits 3285d692ebf200e9cbeff59d1ccc00caab99ad54 (7.x) and 966e227a1a8b520ea1652e2eb3ca78b08d3206f5 (6.x), described in advisory GHSA-j39j-wmxg-j8mv; downstream packagers should backport these commits if they cannot move to the fixed tags. If immediate upgrade is not possible, the most effective compensating control is to avoid the specific code path: ensure no untrusted or externally supplied image is written to PDF with JPEG2000 compression applied to CMYK data - configure PDF export to use Flate/Zip or JPEG compression instead, or, where the PDF-writing feature is not required, remove or restrict the PDF coder. This can be enforced with an ImageMagick policy.xml that denies the PDF coder (or restricts its write mode) for untrusted input; the trade-off is that legitimate PDF-generation workflows in the same process will break and must be re-routed to a sandboxed or separately configured instance. Deployments that must retain PDF output should run conversions in a resource-limited, isolated process (seccomp/container with memory and crash-restart limits), since the worst-case impact is a process crash rather than code execution; also consider sanitizing/validating the colorspace and compression parameters accepted from any user-influenced conversion request. Monitor the vendor advisory and distro trackers for backport status, as the CPE ranges indicate the flaw persists across the entire pre-fix 6.x and 7.x lines.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a use-after-free (CWE-416) rooted in how ImageMagick's PDF encoder manages ICC color profiles during PDF generation. In coders/pdf.c, WritePDFImage called GetCompatibleColorProfile(image) early and then, for certain CMYK inputs, invoked TransformImageColorspace(image, sRGBColorspace, exception), which can replace or release the image's profile data while the earlier-derived profile pointer is still held and subsequently dereferenced - freeing memory that is then reused. The vulnerability specifically manifests with JPEG2000Compression combined with a non-sRGB-compatible (CMYK) colorspace. The upstream fix computes a per-kid-image compression value (honoring image_info->compression when set), guards the ICC-profile usage so that a JPEG2000-compressed child image is only treated as profile-bearing when its colorspace is sRGB-compatible, and moves icc_profile=GetCompatibleColorProfile(image) to after the colorspace transformation so the pointer is fetched from the transformed image. Two parallel commits address the 7.x line (3285d692) and the 6.x line (966e2271). The CPE entries (cpe:2.3:a:imagemagick:imagemagick) confirm the affected component is the core ImageMagick distribution rather than a wrapper or downstream product.
Know when Imagemagick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
AC:H because the app must be configured to write PDF with JPEG2000 compression on CMYK images; PR:N/UI:N since attacker only supplies the image; impact is crash-only, so C:N/I:N/A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Imagemagick
View allThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to
The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
Exploit-DB