Imagemagick
Monthly
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Command injection in ImageMagick's SVG decoder (coders/svg.c) lets attackers smuggle arbitrary MVG (Magick Vector Graphics) drawing commands inside an SVG file that execute when the image is rendered, affecting versions before 7.1.2-15 and 6.9.13-40 (and the Magick.NET bindings before 14.10.3). Because ImageMagick frequently processes untrusted, user-uploaded images on servers, a crafted SVG can achieve high-impact abuse of the internal MVG rendering pipeline. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.91% (55th percentile), but SSVC flags exploitation as automatable.
Out-of-bounds heap write in ImageMagick's ICON decoder allows remote attackers to crash the application by supplying a maliciously crafted ICON file processed by versions prior to 6.9.13-50 and 7.1.2-25. The flaw stems from an incorrect loop condition during ICON parsing, leading to memory corruption and denial of service. No public exploit identified at time of analysis, but ImageMagick's broad deployment as an image-processing backend in web applications makes drive-by exposure plausible.
Denial of service in ImageMagick prior to 6.9.13-50 and 7.1.2-25 allows remote attackers to trigger an out-of-memory condition by submitting crafted images that bypass memory request validation in the AcquireAlignedMemory routine. The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) vector reflects unauthenticated network exploitability with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and the issue is not present on the CISA KEV list.
Stack exhaustion in ImageMagick's XML tree parser allows remote unauthenticated attackers to trigger denial-of-service conditions by submitting specially crafted XML files with deeply nested structures. Affects all versions below 6.9.13-44 and 7.1.2-19 across multiple platforms including the Magick.NET wrapper. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability, though the network-accessible attack vector (AV:N) and lack of authentication requirements (PR:N) present theoretical risk for internet-facing deployments processing untrusted XML input.
Heap buffer overflow in ImageMagick's MVG decoder enables network-based denial of service through crafted image files. Affects all ImageMagick versions prior to 6.9.13-44 and 7.1.2-19. CVSS 7.5 (HIGH) with remote unauthenticated exploitation (AV:N/PR:N), but EPSS score of 0.04% (11th percentile) indicates minimal observed exploitation probability. No active exploitation confirmed (not in CISA KEV), no public POC identified. Vendor-released patches available in versions 6.9.13-44 and 7.1.2-19, with upstream fix committed at 4c72003e9e54.
High severity vulnerability in ImageMagick. MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack.
High severity vulnerability in ImageMagick. An integer overflow in DIB coder can result in out of bounds read or write
High severity vulnerability in ImageMagick. An uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check.
High severity vulnerability in ImageMagick. A stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption.
ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are vulnerable to denial of service when processing maliciously crafted SVG files due to an off-by-one error in boundary validation. An unauthenticated remote attacker can trigger an integer underflow by bypassing the flawed size check, causing the application to crash or become unresponsive. No patch is currently available for affected deployments.
Imagemagick versions up to 7.1.2-15 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Denial of service in ImageMagick prior to 7.1.2-15 stems from a memory leak in the WriteASHLARImage function within coders/ashlar.c, where an allocated structure is not released when an exception is thrown during ASHLAR image encoding. Remote attackers who can submit images for processing can trigger repeated leaks to exhaust process memory in long-running services that embed ImageMagick. No public exploit identified at time of analysis, and EPSS risk is negligible at 0.05% (16th percentile).
Stack buffer overflow in ImageMagick's MSL (Magick Scripting Language) parser allows remote attackers to corrupt memory and potentially execute arbitrary code by supplying an MSL document with an oversized attribute value processed by msl.c. All ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are affected, as well as Magick.NET bindings below 14.10.3. No public exploit identified at time of analysis and EPSS is very low (0.06%, 17th percentile), but the CVSS 9.8 reflects the worst-case unauthenticated RCE potential against any service that parses attacker-controlled MSL input.
Stack-based buffer overflow in ImageMagick versions before 7.1.2-15 allows remote attackers to crash the application and potentially corrupt memory by submitting specially crafted FTXT image files. The vulnerability requires high complexity to exploit but impacts both confidentiality and availability of affected systems. No patch is currently available for this HIGH severity issue (CVSS 7.4).
Local file disclosure in ImageMagick before 7.1.2-15 and 6.9.13-40 lets attackers bypass the path security policy (policy-secure.xml) using directory traversal, reading files a rule such as `/etc/*` was meant to block. Because the policy matcher evaluates the raw, unnormalized filename string before the OS resolves it, a traversal sequence slips past the deny rule while the kernel still opens the real sensitive file. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but the bug undermines a control specifically deployed to harden image-processing pipelines that handle untrusted input.
Integer overflow in ImageMagick's UHDR image decoder allows remote attackers to trigger heap buffer overflows by supplying specially crafted images with large dimensions, potentially crashing the application or corrupting heap memory. The vulnerability affects ImageMagick versions prior to 7.1.2-15 and requires no user interaction or authentication to exploit. Organizations using vulnerable versions should upgrade immediately, as no workaround is available.
ImageMagick is free and open-source software used for editing and manipulating digital images. [CVSS 7.5 HIGH]
Heap memory disclosure in ImageMagick's PSD file parser allows unauthenticated remote attackers to leak sensitive information from process memory by crafting malicious Photoshop files with improperly compressed layer data. Affected versions prior to 7.1.2-15 and 6.9.13-40 fail to properly validate decompressed data sizes, exposing uninitialized heap contents in generated output images. No patch is currently available for this vulnerability.
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled data past an allocated heap buffer by submitting a maliciously crafted XBM file, affecting all versions prior to 7.1.2-13 and 6.9.13-38. Because any read or identify operation triggers the flaw, it is reachable through ordinary image upload and conversion pipelines, raising the risk of memory corruption and potential remote code execution. Publicly available exploit code exists and a vendor patch is available, though EPSS exploitation probability remains low (0.08%) and it is not listed in CISA KEV.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Denial of service in ImageMagick affects Alpine Linux package versions prior to 7.1.2.24-r0, where improper input validation allows remote attackers to trigger high availability impact without authentication or user interaction. The flaw is tracked under upstream advisory GHSA-8pj9-6897-74xc and was disclosed via Alpine's security tracking. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap buffer underwrite in ImageMagick's PICT decoder (coders/pict.c) on 32-bit builds allows unauthenticated remote attackers to corrupt memory below the allocated buffer by supplying a crafted PICT file with maximized row, column, and bytes-per-line values, potentially causing a crash or code execution. Affected versions are ImageMagick before 7.1.2-33 (7.x) and before 6.9.13-58 (6.x) when compiled as 32-bit; 64-bit builds are not affected. No public exploit code has been identified at the time of analysis, and the CVSS v4.0 score is 6.3 (moderate) with high attack complexity per the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
Denial of service in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32, where a type confusion in the INFO, JSON and YAML encoders lets a locally positioned low-privilege user crash the ImageMagick process (SIGABRT or SIGSEGV) when an image is written to a compressed or blob-backed output stream. The flaw is reached only when the write targets a non-FILE stream such as zip:, bzip2: or a blob/FIFO destination, so ordinary file, pipe and standard-stream output are unaffected; impact is limited to availability of the single process, with no confidentiality or integrity loss. This is a genuinely low-priority issue - the assessed vector is local, low-privilege and availability-only - and no public exploit identified at time of analysis, though vendor patches are available.
Heap buffer over-read in ImageMagick's -fx expression processor affects versions 7.1.0-21 through 7.1.2-31, allowing a local, low-privileged attacker who can get a crafted -fx expression evaluated to read past the end of an allocated heap buffer and disclose limited memory contents or trigger a crash. The issue is rated CVSS 4.0 4.8 (AV:L/AC:L/PR:L/UI:N, confined to low confidentiality and availability impact), and there is no public exploit identified at time of analysis. Practical risk is highest where a service passes untrusted input into ImageMagick -fx expressions and is comparatively small for typical operator-driven command-line use, matching the independent assessment that this is a low-to-moderate priority issue rather than a high-severity emergency.
ImageMagick 7.1.0-20 through 7.1.2-31 can crash or corrupt memory through a use-after-free in the MagickCore -fx expression evaluator, which is reached when the internal RPN element table must grow and the underlying memory allocation fails. Exploitation is constrained: it requires a local, low-privileged caller who can supply crafted -fx expressions to a process that is simultaneously under genuine memory pressure (the AT:P precondition in the CVSS 4.0 vector, base score 2.0), and the independent assessment caps impact at low availability loss with no confidentiality or integrity effect. The condition is not attacker-deterministic under ordinary conditions, no public exploit code has been identified at time of analysis, and this is not confirmed actively exploited (no CISA KEV listing), making it a genuinely low-priority issue whose signals are consistent rather than conflicting.
Heap buffer over-write in ImageMagick versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) is triggered when the security policy is read and written concurrently by multiple threads, crashing the application and causing a denial of service. Exploitation requires local low-privileged code execution (CVSS:4.0 AV:L/PR:L) inside a process that embeds the library and that modifies its policy at runtime, combined with winning a probabilistic timing race (AT:P); the flaw yields no confidentiality or integrity impact, only availability loss. No public exploit code has been identified at time of analysis, and vendor-released patches are available as 6.9.13-57 and 7.1.2-32.
Repeated wavelet-denoise processing of attacker-influenced images in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32 leaks the internal noise-image buffer whenever a required resource cannot be acquired on a resource-constrained host, letting remote unauthenticated attackers gradually degrade service availability through many requests. The leak is confined to the allocation-failure branch, so there is no single-shot crash, no code execution, and no data exposure, making this a medium/low-priority availability issue rather than a critical one. No public exploit code has been identified and there is no evidence of active exploitation, while vendor patches are available.
Local policy bypass in ImageMagick's -script operation (versions before 7.1.2-32) lets a low-privileged local user close file descriptors not opened by the current operation, undermining security restrictions configured in policy.xml. The flaw is a CWE-404 resource lifecycle issue (CVSS 4.0 base 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) with availability-only impact and no scope change; it is most relevant where policy.xml is used as a containment boundary for untrusted ImageMagick operations. No public exploit code or active exploitation was identified at time of analysis, and vendor-released patch 7.1.2-32 is available.
Repeated processing of attacker-supplied JNG images by ImageMagick before 6.9.13-57, or 7.x before 7.1.2-32, leaves temporary files on disk, letting unauthenticated remote attackers gradually exhaust storage and degrade service availability. The effect is cumulative rather than immediate: a single crafted file leaks only a small amount of disk, so meaningful impact requires many submissions and depends on the host's free space and temporary-directory quotas. Vendor patches exist for both release lines (6.9.13-57 and 7.1.2-32), and no public exploit code or confirmed actively exploited (CISA KEV) status was identified at time of analysis; the CVSS 4.0 score of 6.9 reflects low availability impact only, with no confidentiality or integrity effect.
Code injection through crafted MVG (Magick Vector Graphics) drawing files can reach ImageMagick's PostScript rendering path, where an attacker-controlled font name is embedded into a generated PostScript stream and handed to a Ghostscript delegate. The flaw affects ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32 and is reachable by unauthenticated remote attackers (PR:N, UI:N) who can cause a malicious MVG file to be decoded, but only when ImageMagick is built with a PostScript renderer and the text-rendering call actually takes the RenderPostscript path rather than FreeType (attack requirements: present). Resulting impact is limited to integrity and availability of the conversion process (no confidentiality loss); there is no public exploit identified at time of analysis, and the vendor rates the issue medium at CVSS 4.0 base 6.3, so it is a moderate, conditional priority rather than an emergency.
Local file disclosure in ImageMagick before 7.1.2-32 stems from a time-of-check time-of-use symlink race in the MagickWand script-token loader, which lets an attacker who can already invoke a magick script replace an authorized path with a symlink in the window between the policy check and the actual file open. The impact is limited: it only matters on installations that deploy a restrictive policy.xml ReadPolicyRights (there is nothing to bypass on default configurations), the attacker must win a non-deterministic race, and the result is read-only disclosure of files the policy intends to block - consistent with the low assessed severity. No public exploit was identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch is available in ImageMagick 7.1.2-32.
ImageMagick releases before 6.9.13-57 and 7.x before 7.1.2-32 expose a single uninitialized byte of process memory through the internal PostScript (PS) decoder, allowing unauthenticated remote attackers who can submit a crafted PS file to read one byte of stale heap contents via the decoded ICC profile. The root cause is an off-by-one in ReadPSInfo in coders/ps.c, where the ICC profile string length is set to the decoded length plus one, so the buffer is one byte longer than the data written into it. Exploitation requires that the application actually routes attacker-supplied PostScript into ImageMagick and that the resulting output (for example the generated image or its ICC profile) is returned to the attacker; no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact is capped at a single byte per request with no integrity or availability effect, making this a low-to-moderate priority issue despite the 6.9 CVSS 4.0 base score.
Crashing ImageMagick's PostScript decoder is achievable with a crafted PostScript or EPS file: in ImageMagick versions from 7.1.1-31 up to but not including 7.1.2-32, the PostScript coder (coders/ps.c) dereferences a NULL profile pointer once a resource policy limit is reached during decoding, terminating the process and denying service to any application, pipeline, or web service that converts untrusted images. The issue is remotely reachable without authentication or user interaction (CVSS 4.0 base 6.3; independently assessed as availability-only under CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at the time of analysis. Impact is confined to a process crash - there is no disclosure, modification, or code execution.
Denial of service in ImageMagick 7.1.2-30 and 7.1.2-31: a crafted image handled by the WBINFO (Amiga icon) decoder can corrupt memory through a use-after-free - classified in the CVE record as CWE-415 - and crash the process, but only when a memory allocation fails during that decode. The allocation-failure prerequisite (AT:P in the CVSS 4.0 vector) is the main limiter, since a remote attacker cannot reliably force the condition without the target already being under memory pressure, although no authentication (PR:N) and no user interaction (UI:N) are required where images are decoded automatically. No public exploit code and no CISA KEV listing were identified at time of analysis, and vendor patches are available.
ImageMagick before 7.1.2-32 leaks heap memory when its command-line -process option is invoked with certain crafted arguments, allowing an attacker who can run the magick/convert tooling and influence those arguments to gradually exhaust memory and degrade service availability. The flaw is classified as CWE-401 (missing release of memory) and is strictly local, requiring at least low-level privileges to execute the CLI (AV:L/PR:L per the assessed vector), with impact limited to low availability loss and no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor has published a fix commit and an advisory, and the issue rates as medium severity (CVSS 4.0 base 4.8) with low real-world urgency.
An uninitialized-memory information disclosure in ImageMagick's JPEG decoder affects all 6.x releases before 6.9.13-57 and 7.x releases before 7.1.2-32, allowing a remote, unauthenticated attacker to leak process memory by submitting a crafted JPEG for processing. The flaw is triggered when decoding a JPEG whose component count is fewer than four (for example single-component grayscale or 3-component YCbCr images), causing the decoder to read uninitialized fields from the JPEG component array; the leaked bytes are surfaced through the image's sampling-factor property, so exposure depends on whether the hosting application echoes image metadata back to the attacker. Exploitability is limited and disclosure reachability is conditional; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisories and fixing commits are public. Vendor-released patches exist in 6.9.13-57 and 7.1.2-32, making this a moderate-priority remediation item rather than an emergency.
Use-after-free in ImageMagick's PDF writer (coders/pdf.c) can crash the process when a CMYK-colorspace image is written to PDF using JPEG2000 compression; affected releases are ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32. The attacker supplies the crafted CMYK image, but the trigger is the operator-side PDF export operation with JPEG2000 compression selected, which is not the default output mode - reading or decoding the image alone does not reach the vulnerable code path. The issue is a low-impact availability defect (no confidentiality or integrity loss), unauthenticated per the CVSS PR:N vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor patches exist as commits in the ImageMagick and ImageMagick6 repositories.
Stack exhaustion in the ImageMagick MSL decoder affects 6.x before 6.9.13-57 and 7.x before 7.1.2-32, allowing remote, unauthenticated attackers to crash the image-processing process by supplying a set of crafted MSL images whose cross-references drive the decoder's recursion past its stack limit; the result is availability-only denial of service with no confidentiality or integrity impact. Reachability is conditional: MSL is a scripting pseudo-coder rather than a normal raster format, so the target application must actually pass attacker-controlled MSL input to ImageMagick, and MSL is commonly disabled or restricted through the security policy.xml, which both the vendor advisory and independent analysis identify as the primary limiting factor. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; vendor patches are available as fixed releases 6.9.13-57 and 7.1.2-32.
ImageMagick's CIP (Cisco IP Phone) encoder fails to escape input-derived data, allowing markup injection into the generated XML output when a crafted image is converted to the .cip format. Affected versions are ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32; exploitation requires that an application actually invoke the CIP coder, which is non-default and must be explicitly requested. Per the assessed vector, the impact is limited to low integrity (markup corruption of the emitted XML) with no confidentiality or availability loss, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Malformed XMP metadata profiles in ImageMagick builds from 7.1.1-7 up to (but not including) 7.1.2-32 cause a heap buffer over-read that lets an attacker read past the end of an allocated buffer and typically crash the process. The flaw sits in the XMP profile synchronization code and is reachable by unauthenticated remote attackers (CVSS:4.0 PR:N/UI:N) whenever a service parses an untrusted image - upload handlers, thumbnailers, format converters, PDF/report generators, or any pipeline using an affected library build. Impact is limited to availability (VC:N/VI:N/VA:L, independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), so the realistic outcome is a denial-of-service crash rather than code execution or confirmed data disclosure; no public exploit code or CISA KEV entry has been identified at time of analysis, and a vendor patch is available.
Uncontrolled recursion in ImageMagick's MVG/SVG decoding path allows a crafted image file with deeply nested image or drawing references to exhaust the process stack and crash the application, producing a denial of service. All ImageMagick releases before 6.9.13-57 on the legacy 6.x branch and before 7.1.2-32 on the 7.x branch are affected, and the MVG/SVG coders ship in default builds, so exposure is determined by whether a deployment routes untrusted input into ImageMagick's decoder pipeline (upload handling, conversion, thumbnailing). No public exploit code has been identified at time of analysis, this CVE is not in CISA KEV, and the CVSS 4.0 base score of 6.3 with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a medium-severity availability-only impact with no confidentiality, integrity, or code-execution consequences.
Memory exhaustion in ImageMagick before 6.9.13-57 (6.x line) and before 7.1.2-32 (7.x line) lets unauthenticated attackers leak memory by feeding crafted input to the YUV encoder, which fails to free allocated image buffers when a specific encoder operation fails. The impact is availability-only (CWE-401 memory leak, assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor/NVD CVSS 4.0 base 6.3), and because each failure leaks only incrementally, a practical denial of service requires repeated, high-volume triggering of the failing path. Exploitation is gated by the target application actually producing YUV output, since the flaw lives in coders/yuv.c WriteYUVImage and deployments that never write YUV are not exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
A memory leak in ImageMagick's SVG encoder (WriteSVGImage) causes allocated memory to be unreleased when crafted images drive the encoder into specific error paths, allowing repeated processing of such images to exhaust available memory and degrade or halt the service. Affected are releases before 6.9.13-57 (6.x) and 7.x before 7.1.2-32, and exploitation requires the target deployment to actually write or convert images to SVG output, not merely read SVG input. The issue is availability-only (no confidentiality or integrity impact), no public exploit code has been identified at time of analysis, and vendor patches are available.
Repeated GIF encoding of crafted or attacker-influenced images can steadily exhaust process memory in ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32, because the GIF encoder fails to release allocated buffers when color quantization fails. Remote, unauthenticated attackers who can get an application to convert or write images to GIF output can trigger a small, bounded leak on each attempt, and enough repetitions degrade availability (CVSS 4.0 base 6.3; our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code was identified at time of analysis, and there is no code execution, data exposure, or privilege gain associated with this flaw.
A memory leak in ImageMagick's PNG encoder (coders/png.c, WriteOnePNGImage) fails to release the image and image_info structures when libpng write-structure initialization fails, allowing any unauthenticated remote party who can repeatedly drive PNG encoding operations into that failure path to steadily exhaust process memory and cause a denial of service. Affected are all ImageMagick 6.x releases before 6.9.13-57 and 7.x releases before 7.1.2-32; the vendor has released fixed versions (6.9.13-57 and 7.1.2-32) and upstream commits, and no public exploit code was identified at time of analysis. Impact is availability-only and low in magnitude per both the vendor's CVSS 4.0 score of 6.3 and our independent CVSS 3.1 assessment of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, because the leak only compounds after the host is already experiencing libpng allocation failures - the practical risk is moderate and typically relevant to services that encode attacker-supplied images at scale.
ImageMagick's Truevision TGA image decoder can copy uninitialized stack memory into processed output, allowing a crafted TGA file to disclose residual contents of the ImageMagick process's memory to the party that receives or observes the decoded image. Versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) are affected, and exploitation requires a pipeline that automatically passes attacker-supplied TGA input to the decoder (upload, conversion, or thumbnail generation); the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N rates this as a moderate-severity information disclosure with limited confidentiality impact rather than a high-priority compromise. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, and vendor patches that resolve the underlying uninitialized-read defect are available. The practical severity is constrained because the leaked bytes are non-deterministic uninitialized stack data and the attacker must be able to retrieve the decoder's output to recover them.
An invalid memory free in ImageMagick's fx expression evaluator (MagickCore/fx.c) lets a local attacker with low privileges crash the process by forcing initialization of an FX runtime entry to fail, producing a denial-of-service condition in applications that pass attacker-controlled input to the -fx operator. Only the error-cleanup path is defective - the code frees fxrts[t] instead of fxrts[t2] - so the bug does not trigger during normal FX usage or default processing of benign images, and there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis and the issue is not referenced by CISA KEV; the independent assessment rates it low (CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and vendor fixes are available.
ImageMagick 6.9.13-57 and earlier and 7.1.2-32 and earlier allow a local attacker to bypass configured security policy restrictions by pointing a symbolic link at a policy-restricted path, because the IsRightsAuthorizedByName rights check fails to account for symlinks and evaluates the wrong target. Exploitation requires a pre-existing local account with permission to create symlinks (low privileges, PR:L) plus a deployment that actually enforces ImageMagick policy.xml as a trust boundary; where no such policy is configured there is nothing to bypass. Impact is confined to low-level confidentiality and integrity loss with no availability impact, and no public exploit code has been identified at time of analysis.
Resource exhaustion in ImageMagick's MAT image decoder (coders/mat.c) lets a crafted, highly compressed MAT file inflate far beyond the configured security-policy resource limit, writing an oversized temporary file to disk and consuming excessive storage until the host runs out of temp space. All ImageMagick releases before 7.1.2-30 (7.x line) and before 6.9.13-55 (6.x line) are affected, and the flaw is unauthenticated and remotely reachable per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) wherever untrusted image input is accepted, such as upload, conversion, or thumbnailing services; deployments that only process trusted local images face a much narrower exposure. Impact is confined to availability - there is no code execution, data disclosure, or integrity loss - and the vendor has shipped fixes in 7.1.2-30 and 6.9.13-55; no public exploit has been identified at time of analysis.
A crafted RSVG/SVG image can crash ImageMagick builds that lack Cairo support by forcing the RSVG decoder to free image state twice and then operate on freed memory (CWE-415 double free), yielding an availability-only denial of service rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw affects ImageMagick versions prior to 7.1.2-30 and 6.9.13-55 and is reachable by unauthenticated remote attackers who can get the application to process a malicious image, though exploitation requires the target to be a non-Cairo build and the image must actually trip an internal resource limit. Vendor fixes are published for both the 7.x and 6.x lines; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial-of-service in ImageMagick versions before 7.1.2-30 and 6.9.13-55 allows remote unauthenticated attackers to terminate an image-processing process by supplying a crafted image containing a deeply recursive XMP profile. The flaw only affects availability of the single ImageMagick task or worker-CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L-because the recursion limit is treated as a fatal error rather than a recoverable exception; there is no disclosure, corruption, or code execution. At time of analysis, no public exploit code or active exploitation was identified.
A missing security-policy enforcement check in ImageMagick's CUT image decoder allows a crafted CUT-format file to cause the library to open and read a companion '.PAL' palette file that an administrator's policy.xml explicitly restricts, resulting in limited information disclosure and a possible denial-of-service crash of the decoding process. The flaw affects ImageMagick versions prior to 7.1.2-31 (7.x branch) and prior to 6.9.13-56 (6.x branch), and exploitation requires a local decode operation - such as an upload-processing pipeline that runs 'convert', 'magick' or an application embedding the ImageMagick library - where a restrictive read policy is actually in place; on an unrestricted installation there is no policy to bypass and the security consequence is minimal. The issue is rated CVSS 3.1 4.0 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L), no privileges are required, attack complexity is high, and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a medium-to-low-priority issue: a genuine defence-in-depth control failure rather than a remotely reachable compromise vector.
ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56 can be induced to bypass a security policy configured with the 'coder' domain, allowing a crafted image to load a coder that the policy was meant to block and thereby read data that policy prohibits. The flaw matters only to deployments that actually configure a coder-based deny policy - typically security-conscious hosting, CI, or image-processing pipelines that pass untrusted user-supplied images into ImageMagick - where the bypass defeats the intended hardening and exposes file content to confidentiality loss. The CVSS base score is 6.2 with PR:N in the vector, so unauthenticated attackers can trigger it, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the fixing commits are public. Note a scoring discrepancy: NVD rates the vector AV:L while our independent assessment scores it AV:N, reflecting that such images are commonly delivered through remote upload pipelines.
ImageMagick versions prior to 7.1.2-31 (v7) and 6.9.13-56 (v6) contain a denial-of-service flaw in the MVG (Magick Vector Graphics) decoder where a crafted image can trigger an invalid memory free and crash the process. The issue requires the target to process an image with attacker-controlled MVG content (e.g., via an upload handler or conversion service); the HIGH attack complexity (AC:H) reflects that triggering the invalid free depends on specific primitive/coordinate conditions. The flaw is unauthenticated and remote (AV:N/PR:N) but causes only a process crash with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and patched versions 7.1.2-31 and 6.9.13-56 are available.
Code injection in ImageMagick's PostScript and PDF output coders allows attacker-controlled text such as an image label to be written into generated PostScript/PDF output without escaping, so an injected PostScript operator can execute when that output is later rendered by an interpreter such as Ghostscript. Affected are ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56; exploitation is not confirmed actively exploited (CISA KEV) and no public exploit code is identified at time of analysis. The assessed severity is medium (independent CVSS 5.3 / evaluated vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is remote and requires no authentication, but exploitation demands a high-complexity chain in which a conversion writes a label out through the ps, ps2, ps3, or pdf coder and the resulting file is subsequently rendered.
ImageMagick versions prior to 7.1.2-31 can be driven into excessive CPU consumption when the XMP profile parser resolves an attacker-supplied rational (numerator/denominator) value, degrading or stalling the service that performs the image conversion. The affected path is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but requires the application to feed attacker-controlled image data through ImageMagick, so the practical exposure is limited to upload, convert, or thumbnail pipelines that process untrusted images and read embedded XMP metadata. Impact is bounded to availability degradation - there is no memory corruption, data disclosure, or code execution - and no public exploit code was identified at time of analysis; the vendor has released ImageMagick 7.1.2-31 as the fix.
Repeated processing of crafted Magick scripts in ImageMagick versions prior to 7.1.2-31 leaks a file descriptor on each invocation, allowing unauthenticated remote attackers to exhaust a process's open-file-descriptor table and deny service to applications that exercise the MagickWand script-token (MSL/conjure) path. The issue is rated CVSS 5.3 with availability-only impact (C:N/I:N/A:L) and requires sustained or repeated request volume to be effective, since a single invocation is harmless and the leak is cleared by a process restart. No public exploit identified at time of analysis, and the vendor-released patch is version 7.1.2-31.
Heap buffer overflow in ImageMagick's distributed pixel cache (DPC) server (versions prior to 7.1.2-31) allows an unauthenticated adjacent-network attacker to crash the server by sending crafted pixel data that causes an integer overflow in the packet size calculation. Exploitation requires the target to run the opt-in DPC clustering feature, which is not enabled by default and is not reachable via normal image processing paths. No public exploit identified at time of analysis. This is a moderate availability-only issue (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per independent assessment).
Unbounded MVG macro expansion in ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 lets a crafted Magick Vector Graphics image drive the MVG decoder into an excessively long-running render, degrading availability of any service that processes attacker-supplied MVG-capable content. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the issue is remotely reachable without authentication or user interaction, but impact is limited to partial availability loss with no confidentiality or integrity effect. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and EPSS data was not provided; the practical risk is tied mainly to whether a deployment actually renders untrusted MVG input. The vendor has released fixes in ImageMagick 7.1.2-31 and 6.9.13-56.
Uncontrolled recursion in ImageMagick's CALS decoder lets a crafted CALS image exhaust the call stack and terminate the decoding process, giving remote unauthenticated attackers a low-impact denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). All ImageMagick releases prior to 7.1.2-30 (7.x branch) and prior to 6.9.13-55 (6.x branch) are affected; the vulnerable code path is coders/cals.c (ReadCALSImage). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical reach is limited because the target must actually accept and decode the niche CALS Type 1 raster format rather than common JPEG/PNG inputs.
Integer overflow in ImageMagick's pixel-cache allocation path (GetVirtualPixels / SetPixelCacheNexusPixels) lets a locally supplied crafted call with attacker-controlled width, height, and channel/metacontent values overflow MagickSizeType arithmetic and write past a heap buffer, crashing the affected process. All ImageMagick releases prior to 6.9.13-56 (6.x line) and 7.1.2-31 (7.x line) are affected; the assessed CVSS is 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning impact is confined to a denial of service with no confidentiality or integrity loss and no demonstrated code execution. Exploitation is local and high-complexity because a precise overflow condition must be induced; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided in the available intelligence. Vendor-released patches exist in 6.9.13-56 and 7.1.2-31.
Denial of service in ImageMagick's distributed pixel cache (DPC) server before 7.1.2-32 allows an unauthenticated attacker on the same network segment to repeatedly open connections to the DPC listening socket and exhaust its available connection slots, degrading or halting distributed cache service on the host. The issue is limited to deployments that have explicitly enabled and network-exposed the DPC server - it is not part of default ImageMagick usage - and the assessed impact is availability-only (CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 4.3); no data disclosure or modification is possible. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), while the vendor-released fix is available in ImageMagick 7.1.2-32.
Denial of service in ImageMagick's Adobe Swatch Exchange (ASE) decoder allows a crafted ASE file to crash the process or trigger a long-running, resource-draining operation in all builds prior to 7.1.2-32. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) wherever an application passes untrusted image data to ImageMagick with the ASE coder enabled, but impact is limited to availability (C:N/I:N/A:L) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch exists in 7.1.2-32, so the practical risk is moderate and primarily relevant to image-processing services, upload pipelines, and thumbnailers that accept arbitrary files.
Denial of service in ImageMagick caused by an infinite loop when parsing XMP metadata: a crafted XMP profile embedded in an image drives the internal XML entity parser into a non-terminating loop, so the image processing operation never completes and the worker thread or process burns CPU indefinitely. All builds prior to 7.1.2-32 (7.x line) and 6.9.13-57 (6.x line) are affected, including the many applications and language bindings that embed ImageMagick for thumbnail generation, upload validation, or media pipelines. The flaw is remotely triggerable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3) wherever an attacker-supplied image reaches an automated parser; impact is limited to availability (hang/resource exhaustion) with no memory corruption, data disclosure, or code execution, and no public exploit code was identified at time of analysis.
Denial of service in ImageMagick's PSD decoder occurs on 32-bit builds when processing a crafted PSD file with a malicious image resource block offset, causing an integer-conversion error that leads to an infinite loop. The vulnerability affects versions prior to 7.1.2-32 (ImageMagick 7) and 6.9.13-57 (ImageMagick 6), with unauthenticated remote attackers able to trigger it (CVSS vector PR:N) but requiring high attack complexity (AC:H) due to the 32-bit precondition and crafted file. No public exploit code or active exploitation has been identified, and the impact is confined to availability; 64-bit builds are not affected.
UNIX symlink-following in ImageMagick's delegate cleanup path allows a local, already-privileged workflow to overwrite a target file with random data. Affected are ImageMagick versions prior to 7.1.2-32 and the ImageMagick6 branch prior to 6.9.13-57; the flaw (CWE-61) causes the shred/cleanup routine to ignore the MAGICK_SHRED_PASSES setting, so it follows attacker-planted symbolic links instead of honoring the configured shred behavior. The attack surface is narrow - CVSS 3.1 scores this 4.0 (AV:L/AC:H/PR:H/UI:R) with integrity-only impact - and no public exploit has been identified at time of analysis; there is no CISA KEV designation.
Denial of service in ImageMagick before 7.1.2-32 (7.x line) and before 6.9.13-57 (legacy 6.x line): a missing end-of-file check in the bzip2 blob reader allows a crafted bzip2-compressed image whose stream is truncated or malformed to drive ReadBlob/EOFBlob into an infinite loop, exhausting processing resources and stalling any service that decodes untrusted image data. No authentication (PR:N) or user interaction (UI:N) is needed, but attack complexity is high (AC:H) because the malformed stream must be deliberately constructed to hit the vulnerable path, and impact is limited to availability (C:N/I:N/A:H) for an assessed CVSS of 5.9. No public exploit identified at time of analysis; the issue is addressed by the upstream commits and the 7.1.2-32 / 6.9.13-57 releases.
Denial of service in ImageMagick versions prior to 7.1.2-32 allows remote, unauthenticated attackers to crash the process by supplying a crafted EXR image that triggers a heap buffer overflow in the EXR decoder. The vulnerability requires an ImageMagick build with EXR/OpenEXR delegate support enabled and an application that passes attacker-controlled EXR files to it; the impact is limited to a single-process crash (low availability). No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 7.1.2-32.
ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57 silently discard the entire contents of a deployment's security policy when policy.xml carries a DOCTYPE declaration whose syntax does not end in ']>', so every restriction the administrator intended (e.g. blocking coders, delegates, or resource-heavy formats) is ignored and the previously forbidden operations succeed. Exploitation is local and privileged: the CVSS 4.0 vector scores it 1.8 (AV:L/AC:H/AT:P/PR:H/UI:N), meaning an actor with high privileges who can write or influence the privileged policy.xml file - or an administrator who authors a non-conforming DOCTYPE by accident - is the trigger, and the bug has no effect on default installations that ship no restrictive policy. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor patches are available in 7.1.2-32 and 6.9.13-57, so this is assessed as a genuinely low-priority hardening issue rather than an urgent remote threat.
Uninitialized heap memory disclosure in ImageMagick's GIF decoder affects versions before 7.1.2-32 and 6.9.13-57. An unauthenticated remote attacker can supply a crafted GIF to a service that decodes images with a vulnerable ImageMagick, causing the application extension handler to read uninitialized heap bytes and store them as image metadata; if that metadata is returned or otherwise readable, sensitive heap contents may leak. The assessed impact is confidentiality-only and partial (VC:L) with high attack complexity (AC:H), and no public exploit has been identified at time of analysis; the vendor has released patches.
Memory-exhaustion denial of service in ImageMagick before 7.1.2-31 stems from the Ultra HDR (UHDR) encoder omitting resource-policy checks while allocating the pixel buffer, so a crafted UHDR image can push allocations past the memory/area/disk limits an operator configured in policy.xml. The flaw is remotely reachable without authentication (CVSS 4.0 vector PR:N/UI:N) in any application that routes untrusted images through ImageMagick's UHDR encoding path, but the independent assessment rates it low priority: AC:H and AT:P reflect a niche code path and a crafted image that must reliably defeat the policy logic, and impact is confined to availability (VC:N/VI:N/VA:L) with no confidentiality, integrity, or code-execution effect. Vendor patch 7.1.2-31 is available; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A division-by-zero in ImageMagick's FLIF encoder allows unauthenticated remote attackers to crash the encoder process by supplying an image whose ticks-per-second field yields a zero divisor, causing a denial of service. Affected versions are ImageMagick before 7.1.2-31 (7.x) and before 6.9.13-56 (6.x); exploitation requires that a target application encode attacker-influenced data to FLIF, a relatively uncommon output format, and no public exploit code or active exploitation has been identified at time of analysis.
ImageMagick's PNM (Netpbm) image coder can be crashed via a NULL pointer dereference when processing a specially crafted or sufficiently large PNM image that pushes the library to its configured memory/resource limit at a specific allocation point where the failed allocation is never checked. The flaw affects ImageMagick releases before 7.1.2-31 on the 7.x branch and before 6.9.13-56 on the legacy 6.x branch, and the outcome is limited to a denial of service - a single-process crash that can be restarted - with no data exposure, integrity loss, or code execution. Severity is low (vendor CVSS 4.0 base 2.3; independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L with high attack complexity and partial prerequisite conditions), no public exploit code was identified at time of analysis, and a vendor-released patch is available.
Memory resource limits configured for ImageMagick are not enforced by the PCD coder (and, per the upstream advisory, the CUBE and HALD coders) when a specific command-line option is supplied, so a local user who can control ImageMagick invocation arguments can push the process past its intended policy limit and cause additional memory allocation. Impact is confined to limited availability degradation - no code execution, no data exposure, no integrity change - and the path is local-only with low privileges required (AV:L/PR:L in the assessed vector). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is rated low priority; vendor fixes 7.1.2-31 (7.x) and 6.9.13-56 (6.x) are available, and environments that invoke ImageMagick with fixed, non-user-controlled arguments are not exposed.
Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.
Heap-use-after-free in ImageMagick's PerlMagick Layer method allows an attacker supplying a crafted list of images to trigger memory access after deallocation, causing a crash. Affected versions include ImageMagick before 7.1.2-30 and the 6.9.x branch before 6.9.13-55. Impact is limited to denial of service (crash); no confidentiality or integrity compromise is possible from this flaw. No public exploit code or active exploitation has been identified at time of analysis.
ImageMagick's video decoder contains a TOCTOU race condition that allows a local low-privileged attacker to bypass the policy.xml path write restrictions by swapping a symlink between the policy validation step and the actual file write operation. Both the ImageMagick 7 branch (before 7.1.2-30) and the legacy ImageMagick 6 branch (before 6.9.13-55) are affected, covering a wide range of deployed versions. No public exploit code exists and no active exploitation has been confirmed; the CVSS 4.0 score of 2.0 accurately reflects the local-access and race-condition constraints.
Heap-use-after-free in ImageMagick's PerlMagick Perl binding crashes the host process via a crafted call to the GetList method. Affected versions span the 6.9.x branch before 6.9.13-55 and the 7.x branch before 7.1.2-30. Impact is limited to denial of service (process crash); no confidentiality or integrity compromise has been demonstrated. No public exploit code or active exploitation is identified at time of analysis.
Path policy enforcement in ImageMagick before 7.1.2-30 on Windows can be circumvented by a local attacker exploiting a TOCTOU symlink race condition (CWE-59), granting unauthorized read or write access to files explicitly blocked by the ImageMagick policy.xml security configuration. The race window opens between the moment ImageMagick validates the symlink target against its policy and the subsequent actual filesystem I/O call, allowing an attacker to atomically swap the symlink to a policy-denied destination in that interval. No public exploit code is identified at time of analysis, CISA has not listed this in KEV, and the CVSS 4.0 base score of 1.0 accurately reflects the high attack complexity and constrained local-only vector.
Memory exhaustion in ImageMagick's MSL image decoder affects versions before 7.1.2-30 (v7 branch) and 6.9.13-55 (v6 branch), enabling unauthenticated network attackers to degrade or crash image-processing services by submitting crafted MSL files that trigger unbounded heap allocation without deallocation. The root cause (CWE-400, Uncontrolled Resource Consumption) lies in the MSL decoder's failure to free allocated memory on certain code paths, allowing cumulative heap exhaustion across repeated requests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.3 (Medium) reflects limited availability-only impact with elevated attack complexity.
Memory budget exhaustion in ImageMagick's OpenPixelCache allows remote unauthenticated attackers to cause a process-level denial of service by repeatedly triggering internal cache operation failures. Affected versions span both the 7.x branch (before 7.1.2-30) and the legacy 6.x branch (before 6.9.13-55), covering a large installed base of web services that process user-supplied images. The vulnerability stems from improper cleanup of memory accounting state on error paths, making the failure accumulative rather than self-correcting. No public exploit or CISA KEV listing has been identified at time of analysis.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
Memory leak in ImageMagick's TIFF encoder - affecting the 7.x branch before 7.1.2-26 and the 6.x branch before 6.9.13-51 - allows an attacker or application to cause gradual memory exhaustion by repeatedly supplying an invalid tiff:tile-geometry parameter during TIFF encoding operations. The flaw scores 2.0 under CVSS 4.0 with only low availability impact, a local attack vector, high complexity, and prerequisite conditions, placing it firmly in the low-severity tier. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis.
Memory leak in ImageMagick's ICON decoder exposes services that process user-supplied images to a potential denial of service. Both the 7.x and 6.x release branches are affected - specifically versions before 7.1.2-26 and 6.9.13-51 respectively. An unauthenticated remote attacker (per CVSS PR:N) who can supply a crafted ICON file to an ImageMagick-processing endpoint can repeatedly trigger allocation failures that are never cleaned up, gradually exhausting process memory. No public exploit or active exploitation has been identified at time of analysis.
Memory leak in ImageMagick's MIFF encoder (CWE-401) affects the 7.x branch before 7.1.2-26 and the 6.x branch before 6.9.13-51, enabling denial of service through resource exhaustion. When a memory allocation fails during MIFF image encoding, previously allocated buffers are not released, causing memory to accumulate across repeated processing calls. The CVSS 4.0 score of 2.1 and a local attack vector (AV:L) with high complexity (AC:H) and specific prerequisites (AT:P) signal a low-priority finding with no public exploit and no CISA KEV listing.
Memory leak in ImageMagick's YUV decoder (versions before 7.1.2-26 and 6.9.x before 6.9.13-51) enables remote denial of service by repeatedly submitting malformed YUV images that trigger a failed blob open, leaking heap memory on each decode attempt. No confidentiality or integrity impact applies; exposure is limited to availability of image-processing services that accept untrusted input. No public exploit code or active exploitation has been identified at time of analysis.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Command injection in ImageMagick's SVG decoder (coders/svg.c) lets attackers smuggle arbitrary MVG (Magick Vector Graphics) drawing commands inside an SVG file that execute when the image is rendered, affecting versions before 7.1.2-15 and 6.9.13-40 (and the Magick.NET bindings before 14.10.3). Because ImageMagick frequently processes untrusted, user-uploaded images on servers, a crafted SVG can achieve high-impact abuse of the internal MVG rendering pipeline. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.91% (55th percentile), but SSVC flags exploitation as automatable.
Out-of-bounds heap write in ImageMagick's ICON decoder allows remote attackers to crash the application by supplying a maliciously crafted ICON file processed by versions prior to 6.9.13-50 and 7.1.2-25. The flaw stems from an incorrect loop condition during ICON parsing, leading to memory corruption and denial of service. No public exploit identified at time of analysis, but ImageMagick's broad deployment as an image-processing backend in web applications makes drive-by exposure plausible.
Denial of service in ImageMagick prior to 6.9.13-50 and 7.1.2-25 allows remote attackers to trigger an out-of-memory condition by submitting crafted images that bypass memory request validation in the AcquireAlignedMemory routine. The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) vector reflects unauthenticated network exploitability with high availability impact but no confidentiality or integrity loss. No public exploit identified at time of analysis, and the issue is not present on the CISA KEV list.
Stack exhaustion in ImageMagick's XML tree parser allows remote unauthenticated attackers to trigger denial-of-service conditions by submitting specially crafted XML files with deeply nested structures. Affects all versions below 6.9.13-44 and 7.1.2-19 across multiple platforms including the Magick.NET wrapper. EPSS score of 0.04% (12th percentile) indicates low observed exploitation probability, though the network-accessible attack vector (AV:N) and lack of authentication requirements (PR:N) present theoretical risk for internet-facing deployments processing untrusted XML input.
Heap buffer overflow in ImageMagick's MVG decoder enables network-based denial of service through crafted image files. Affects all ImageMagick versions prior to 6.9.13-44 and 7.1.2-19. CVSS 7.5 (HIGH) with remote unauthenticated exploitation (AV:N/PR:N), but EPSS score of 0.04% (11th percentile) indicates minimal observed exploitation probability. No active exploitation confirmed (not in CISA KEV), no public POC identified. Vendor-released patches available in versions 6.9.13-44 and 7.1.2-19, with upstream fix committed at 4c72003e9e54.
High severity vulnerability in ImageMagick. MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack.
High severity vulnerability in ImageMagick. An integer overflow in DIB coder can result in out of bounds read or write
High severity vulnerability in ImageMagick. An uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check.
High severity vulnerability in ImageMagick. A stack buffer overflow exists in ImageMagick's morphology kernel parsing functions. User-controlled kernel strings exceeding a buffer are copied into fixed-size stack buffers via memcpy without bounds checking, resulting in stack corruption.
ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are vulnerable to denial of service when processing maliciously crafted SVG files due to an off-by-one error in boundary validation. An unauthenticated remote attacker can trigger an integer underflow by bypassing the flawed size check, causing the application to crash or become unresponsive. No patch is currently available for affected deployments.
Imagemagick versions up to 7.1.2-15 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Denial of service in ImageMagick prior to 7.1.2-15 stems from a memory leak in the WriteASHLARImage function within coders/ashlar.c, where an allocated structure is not released when an exception is thrown during ASHLAR image encoding. Remote attackers who can submit images for processing can trigger repeated leaks to exhaust process memory in long-running services that embed ImageMagick. No public exploit identified at time of analysis, and EPSS risk is negligible at 0.05% (16th percentile).
Stack buffer overflow in ImageMagick's MSL (Magick Scripting Language) parser allows remote attackers to corrupt memory and potentially execute arbitrary code by supplying an MSL document with an oversized attribute value processed by msl.c. All ImageMagick versions prior to 7.1.2-15 and 6.9.13-40 are affected, as well as Magick.NET bindings below 14.10.3. No public exploit identified at time of analysis and EPSS is very low (0.06%, 17th percentile), but the CVSS 9.8 reflects the worst-case unauthenticated RCE potential against any service that parses attacker-controlled MSL input.
Stack-based buffer overflow in ImageMagick versions before 7.1.2-15 allows remote attackers to crash the application and potentially corrupt memory by submitting specially crafted FTXT image files. The vulnerability requires high complexity to exploit but impacts both confidentiality and availability of affected systems. No patch is currently available for this HIGH severity issue (CVSS 7.4).
Local file disclosure in ImageMagick before 7.1.2-15 and 6.9.13-40 lets attackers bypass the path security policy (policy-secure.xml) using directory traversal, reading files a rule such as `/etc/*` was meant to block. Because the policy matcher evaluates the raw, unnormalized filename string before the OS resolves it, a traversal sequence slips past the deny rule while the kernel still opens the real sensitive file. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but the bug undermines a control specifically deployed to harden image-processing pipelines that handle untrusted input.
Integer overflow in ImageMagick's UHDR image decoder allows remote attackers to trigger heap buffer overflows by supplying specially crafted images with large dimensions, potentially crashing the application or corrupting heap memory. The vulnerability affects ImageMagick versions prior to 7.1.2-15 and requires no user interaction or authentication to exploit. Organizations using vulnerable versions should upgrade immediately, as no workaround is available.
ImageMagick is free and open-source software used for editing and manipulating digital images. [CVSS 7.5 HIGH]
Heap memory disclosure in ImageMagick's PSD file parser allows unauthenticated remote attackers to leak sensitive information from process memory by crafting malicious Photoshop files with improperly compressed layer data. Affected versions prior to 7.1.2-15 and 6.9.13-40 fail to properly validate decompressed data sizes, exposing uninitialized heap contents in generated output images. No patch is currently available for this vulnerability.
Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled data past an allocated heap buffer by submitting a maliciously crafted XBM file, affecting all versions prior to 7.1.2-13 and 6.9.13-38. Because any read or identify operation triggers the flaw, it is reachable through ordinary image upload and conversion pipelines, raising the risk of memory corruption and potential remote code execution. Publicly available exploit code exists and a vendor patch is available, though EPSS exploitation probability remains low (0.08%) and it is not listed in CISA KEV.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Denial of service in ImageMagick affects Alpine Linux package versions prior to 7.1.2.24-r0, where improper input validation allows remote attackers to trigger high availability impact without authentication or user interaction. The flaw is tracked under upstream advisory GHSA-8pj9-6897-74xc and was disclosed via Alpine's security tracking. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Heap buffer underwrite in ImageMagick's PICT decoder (coders/pict.c) on 32-bit builds allows unauthenticated remote attackers to corrupt memory below the allocated buffer by supplying a crafted PICT file with maximized row, column, and bytes-per-line values, potentially causing a crash or code execution. Affected versions are ImageMagick before 7.1.2-33 (7.x) and before 6.9.13-58 (6.x) when compiled as 32-bit; 64-bit builds are not affected. No public exploit code has been identified at the time of analysis, and the CVSS v4.0 score is 6.3 (moderate) with high attack complexity per the assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).
Denial of service in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32, where a type confusion in the INFO, JSON and YAML encoders lets a locally positioned low-privilege user crash the ImageMagick process (SIGABRT or SIGSEGV) when an image is written to a compressed or blob-backed output stream. The flaw is reached only when the write targets a non-FILE stream such as zip:, bzip2: or a blob/FIFO destination, so ordinary file, pipe and standard-stream output are unaffected; impact is limited to availability of the single process, with no confidentiality or integrity loss. This is a genuinely low-priority issue - the assessed vector is local, low-privilege and availability-only - and no public exploit identified at time of analysis, though vendor patches are available.
Heap buffer over-read in ImageMagick's -fx expression processor affects versions 7.1.0-21 through 7.1.2-31, allowing a local, low-privileged attacker who can get a crafted -fx expression evaluated to read past the end of an allocated heap buffer and disclose limited memory contents or trigger a crash. The issue is rated CVSS 4.0 4.8 (AV:L/AC:L/PR:L/UI:N, confined to low confidentiality and availability impact), and there is no public exploit identified at time of analysis. Practical risk is highest where a service passes untrusted input into ImageMagick -fx expressions and is comparatively small for typical operator-driven command-line use, matching the independent assessment that this is a low-to-moderate priority issue rather than a high-severity emergency.
ImageMagick 7.1.0-20 through 7.1.2-31 can crash or corrupt memory through a use-after-free in the MagickCore -fx expression evaluator, which is reached when the internal RPN element table must grow and the underlying memory allocation fails. Exploitation is constrained: it requires a local, low-privileged caller who can supply crafted -fx expressions to a process that is simultaneously under genuine memory pressure (the AT:P precondition in the CVSS 4.0 vector, base score 2.0), and the independent assessment caps impact at low availability loss with no confidentiality or integrity effect. The condition is not attacker-deterministic under ordinary conditions, no public exploit code has been identified at time of analysis, and this is not confirmed actively exploited (no CISA KEV listing), making it a genuinely low-priority issue whose signals are consistent rather than conflicting.
Heap buffer over-write in ImageMagick versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) is triggered when the security policy is read and written concurrently by multiple threads, crashing the application and causing a denial of service. Exploitation requires local low-privileged code execution (CVSS:4.0 AV:L/PR:L) inside a process that embeds the library and that modifies its policy at runtime, combined with winning a probabilistic timing race (AT:P); the flaw yields no confidentiality or integrity impact, only availability loss. No public exploit code has been identified at time of analysis, and vendor-released patches are available as 6.9.13-57 and 7.1.2-32.
Repeated wavelet-denoise processing of attacker-influenced images in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32 leaks the internal noise-image buffer whenever a required resource cannot be acquired on a resource-constrained host, letting remote unauthenticated attackers gradually degrade service availability through many requests. The leak is confined to the allocation-failure branch, so there is no single-shot crash, no code execution, and no data exposure, making this a medium/low-priority availability issue rather than a critical one. No public exploit code has been identified and there is no evidence of active exploitation, while vendor patches are available.
Local policy bypass in ImageMagick's -script operation (versions before 7.1.2-32) lets a low-privileged local user close file descriptors not opened by the current operation, undermining security restrictions configured in policy.xml. The flaw is a CWE-404 resource lifecycle issue (CVSS 4.0 base 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) with availability-only impact and no scope change; it is most relevant where policy.xml is used as a containment boundary for untrusted ImageMagick operations. No public exploit code or active exploitation was identified at time of analysis, and vendor-released patch 7.1.2-32 is available.
Repeated processing of attacker-supplied JNG images by ImageMagick before 6.9.13-57, or 7.x before 7.1.2-32, leaves temporary files on disk, letting unauthenticated remote attackers gradually exhaust storage and degrade service availability. The effect is cumulative rather than immediate: a single crafted file leaks only a small amount of disk, so meaningful impact requires many submissions and depends on the host's free space and temporary-directory quotas. Vendor patches exist for both release lines (6.9.13-57 and 7.1.2-32), and no public exploit code or confirmed actively exploited (CISA KEV) status was identified at time of analysis; the CVSS 4.0 score of 6.9 reflects low availability impact only, with no confidentiality or integrity effect.
Code injection through crafted MVG (Magick Vector Graphics) drawing files can reach ImageMagick's PostScript rendering path, where an attacker-controlled font name is embedded into a generated PostScript stream and handed to a Ghostscript delegate. The flaw affects ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32 and is reachable by unauthenticated remote attackers (PR:N, UI:N) who can cause a malicious MVG file to be decoded, but only when ImageMagick is built with a PostScript renderer and the text-rendering call actually takes the RenderPostscript path rather than FreeType (attack requirements: present). Resulting impact is limited to integrity and availability of the conversion process (no confidentiality loss); there is no public exploit identified at time of analysis, and the vendor rates the issue medium at CVSS 4.0 base 6.3, so it is a moderate, conditional priority rather than an emergency.
Local file disclosure in ImageMagick before 7.1.2-32 stems from a time-of-check time-of-use symlink race in the MagickWand script-token loader, which lets an attacker who can already invoke a magick script replace an authorized path with a symlink in the window between the policy check and the actual file open. The impact is limited: it only matters on installations that deploy a restrictive policy.xml ReadPolicyRights (there is nothing to bypass on default configurations), the attacker must win a non-deterministic race, and the result is read-only disclosure of files the policy intends to block - consistent with the low assessed severity. No public exploit was identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch is available in ImageMagick 7.1.2-32.
ImageMagick releases before 6.9.13-57 and 7.x before 7.1.2-32 expose a single uninitialized byte of process memory through the internal PostScript (PS) decoder, allowing unauthenticated remote attackers who can submit a crafted PS file to read one byte of stale heap contents via the decoded ICC profile. The root cause is an off-by-one in ReadPSInfo in coders/ps.c, where the ICC profile string length is set to the decoded length plus one, so the buffer is one byte longer than the data written into it. Exploitation requires that the application actually routes attacker-supplied PostScript into ImageMagick and that the resulting output (for example the generated image or its ICC profile) is returned to the attacker; no public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact is capped at a single byte per request with no integrity or availability effect, making this a low-to-moderate priority issue despite the 6.9 CVSS 4.0 base score.
Crashing ImageMagick's PostScript decoder is achievable with a crafted PostScript or EPS file: in ImageMagick versions from 7.1.1-31 up to but not including 7.1.2-32, the PostScript coder (coders/ps.c) dereferences a NULL profile pointer once a resource policy limit is reached during decoding, terminating the process and denying service to any application, pipeline, or web service that converts untrusted images. The issue is remotely reachable without authentication or user interaction (CVSS 4.0 base 6.3; independently assessed as availability-only under CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at the time of analysis. Impact is confined to a process crash - there is no disclosure, modification, or code execution.
Denial of service in ImageMagick 7.1.2-30 and 7.1.2-31: a crafted image handled by the WBINFO (Amiga icon) decoder can corrupt memory through a use-after-free - classified in the CVE record as CWE-415 - and crash the process, but only when a memory allocation fails during that decode. The allocation-failure prerequisite (AT:P in the CVSS 4.0 vector) is the main limiter, since a remote attacker cannot reliably force the condition without the target already being under memory pressure, although no authentication (PR:N) and no user interaction (UI:N) are required where images are decoded automatically. No public exploit code and no CISA KEV listing were identified at time of analysis, and vendor patches are available.
ImageMagick before 7.1.2-32 leaks heap memory when its command-line -process option is invoked with certain crafted arguments, allowing an attacker who can run the magick/convert tooling and influence those arguments to gradually exhaust memory and degrade service availability. The flaw is classified as CWE-401 (missing release of memory) and is strictly local, requiring at least low-level privileges to execute the CLI (AV:L/PR:L per the assessed vector), with impact limited to low availability loss and no confidentiality or integrity effect. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor has published a fix commit and an advisory, and the issue rates as medium severity (CVSS 4.0 base 4.8) with low real-world urgency.
An uninitialized-memory information disclosure in ImageMagick's JPEG decoder affects all 6.x releases before 6.9.13-57 and 7.x releases before 7.1.2-32, allowing a remote, unauthenticated attacker to leak process memory by submitting a crafted JPEG for processing. The flaw is triggered when decoding a JPEG whose component count is fewer than four (for example single-component grayscale or 3-component YCbCr images), causing the decoder to read uninitialized fields from the JPEG component array; the leaked bytes are surfaced through the image's sampling-factor property, so exposure depends on whether the hosting application echoes image metadata back to the attacker. Exploitability is limited and disclosure reachability is conditional; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisories and fixing commits are public. Vendor-released patches exist in 6.9.13-57 and 7.1.2-32, making this a moderate-priority remediation item rather than an emergency.
Use-after-free in ImageMagick's PDF writer (coders/pdf.c) can crash the process when a CMYK-colorspace image is written to PDF using JPEG2000 compression; affected releases are ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32. The attacker supplies the crafted CMYK image, but the trigger is the operator-side PDF export operation with JPEG2000 compression selected, which is not the default output mode - reading or decoding the image alone does not reach the vulnerable code path. The issue is a low-impact availability defect (no confidentiality or integrity loss), unauthenticated per the CVSS PR:N vector, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; vendor patches exist as commits in the ImageMagick and ImageMagick6 repositories.
Stack exhaustion in the ImageMagick MSL decoder affects 6.x before 6.9.13-57 and 7.x before 7.1.2-32, allowing remote, unauthenticated attackers to crash the image-processing process by supplying a set of crafted MSL images whose cross-references drive the decoder's recursion past its stack limit; the result is availability-only denial of service with no confidentiality or integrity impact. Reachability is conditional: MSL is a scripting pseudo-coder rather than a normal raster format, so the target application must actually pass attacker-controlled MSL input to ImageMagick, and MSL is commonly disabled or restricted through the security policy.xml, which both the vendor advisory and independent analysis identify as the primary limiting factor. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; vendor patches are available as fixed releases 6.9.13-57 and 7.1.2-32.
ImageMagick's CIP (Cisco IP Phone) encoder fails to escape input-derived data, allowing markup injection into the generated XML output when a crafted image is converted to the .cip format. Affected versions are ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32; exploitation requires that an application actually invoke the CIP coder, which is non-default and must be explicitly requested. Per the assessed vector, the impact is limited to low integrity (markup corruption of the emitted XML) with no confidentiality or availability loss, and no public exploit has been identified at time of analysis (not listed in CISA KEV).
Malformed XMP metadata profiles in ImageMagick builds from 7.1.1-7 up to (but not including) 7.1.2-32 cause a heap buffer over-read that lets an attacker read past the end of an allocated buffer and typically crash the process. The flaw sits in the XMP profile synchronization code and is reachable by unauthenticated remote attackers (CVSS:4.0 PR:N/UI:N) whenever a service parses an untrusted image - upload handlers, thumbnailers, format converters, PDF/report generators, or any pipeline using an affected library build. Impact is limited to availability (VC:N/VI:N/VA:L, independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), so the realistic outcome is a denial-of-service crash rather than code execution or confirmed data disclosure; no public exploit code or CISA KEV entry has been identified at time of analysis, and a vendor patch is available.
Uncontrolled recursion in ImageMagick's MVG/SVG decoding path allows a crafted image file with deeply nested image or drawing references to exhaust the process stack and crash the application, producing a denial of service. All ImageMagick releases before 6.9.13-57 on the legacy 6.x branch and before 7.1.2-32 on the 7.x branch are affected, and the MVG/SVG coders ship in default builds, so exposure is determined by whether a deployment routes untrusted input into ImageMagick's decoder pipeline (upload handling, conversion, thumbnailing). No public exploit code has been identified at time of analysis, this CVE is not in CISA KEV, and the CVSS 4.0 base score of 6.3 with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a medium-severity availability-only impact with no confidentiality, integrity, or code-execution consequences.
Memory exhaustion in ImageMagick before 6.9.13-57 (6.x line) and before 7.1.2-32 (7.x line) lets unauthenticated attackers leak memory by feeding crafted input to the YUV encoder, which fails to free allocated image buffers when a specific encoder operation fails. The impact is availability-only (CWE-401 memory leak, assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor/NVD CVSS 4.0 base 6.3), and because each failure leaks only incrementally, a practical denial of service requires repeated, high-volume triggering of the failing path. Exploitation is gated by the target application actually producing YUV output, since the flaw lives in coders/yuv.c WriteYUVImage and deployments that never write YUV are not exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
A memory leak in ImageMagick's SVG encoder (WriteSVGImage) causes allocated memory to be unreleased when crafted images drive the encoder into specific error paths, allowing repeated processing of such images to exhaust available memory and degrade or halt the service. Affected are releases before 6.9.13-57 (6.x) and 7.x before 7.1.2-32, and exploitation requires the target deployment to actually write or convert images to SVG output, not merely read SVG input. The issue is availability-only (no confidentiality or integrity impact), no public exploit code has been identified at time of analysis, and vendor patches are available.
Repeated GIF encoding of crafted or attacker-influenced images can steadily exhaust process memory in ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32, because the GIF encoder fails to release allocated buffers when color quantization fails. Remote, unauthenticated attackers who can get an application to convert or write images to GIF output can trigger a small, bounded leak on each attempt, and enough repetitions degrade availability (CVSS 4.0 base 6.3; our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code was identified at time of analysis, and there is no code execution, data exposure, or privilege gain associated with this flaw.
A memory leak in ImageMagick's PNG encoder (coders/png.c, WriteOnePNGImage) fails to release the image and image_info structures when libpng write-structure initialization fails, allowing any unauthenticated remote party who can repeatedly drive PNG encoding operations into that failure path to steadily exhaust process memory and cause a denial of service. Affected are all ImageMagick 6.x releases before 6.9.13-57 and 7.x releases before 7.1.2-32; the vendor has released fixed versions (6.9.13-57 and 7.1.2-32) and upstream commits, and no public exploit code was identified at time of analysis. Impact is availability-only and low in magnitude per both the vendor's CVSS 4.0 score of 6.3 and our independent CVSS 3.1 assessment of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, because the leak only compounds after the host is already experiencing libpng allocation failures - the practical risk is moderate and typically relevant to services that encode attacker-supplied images at scale.
ImageMagick's Truevision TGA image decoder can copy uninitialized stack memory into processed output, allowing a crafted TGA file to disclose residual contents of the ImageMagick process's memory to the party that receives or observes the decoded image. Versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) are affected, and exploitation requires a pipeline that automatically passes attacker-supplied TGA input to the decoder (upload, conversion, or thumbnail generation); the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N rates this as a moderate-severity information disclosure with limited confidentiality impact rather than a high-priority compromise. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis, and vendor patches that resolve the underlying uninitialized-read defect are available. The practical severity is constrained because the leaked bytes are non-deterministic uninitialized stack data and the attacker must be able to retrieve the decoder's output to recover them.
An invalid memory free in ImageMagick's fx expression evaluator (MagickCore/fx.c) lets a local attacker with low privileges crash the process by forcing initialization of an FX runtime entry to fail, producing a denial-of-service condition in applications that pass attacker-controlled input to the -fx operator. Only the error-cleanup path is defective - the code frees fxrts[t] instead of fxrts[t2] - so the bug does not trigger during normal FX usage or default processing of benign images, and there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis and the issue is not referenced by CISA KEV; the independent assessment rates it low (CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and vendor fixes are available.
ImageMagick 6.9.13-57 and earlier and 7.1.2-32 and earlier allow a local attacker to bypass configured security policy restrictions by pointing a symbolic link at a policy-restricted path, because the IsRightsAuthorizedByName rights check fails to account for symlinks and evaluates the wrong target. Exploitation requires a pre-existing local account with permission to create symlinks (low privileges, PR:L) plus a deployment that actually enforces ImageMagick policy.xml as a trust boundary; where no such policy is configured there is nothing to bypass. Impact is confined to low-level confidentiality and integrity loss with no availability impact, and no public exploit code has been identified at time of analysis.
Resource exhaustion in ImageMagick's MAT image decoder (coders/mat.c) lets a crafted, highly compressed MAT file inflate far beyond the configured security-policy resource limit, writing an oversized temporary file to disk and consuming excessive storage until the host runs out of temp space. All ImageMagick releases before 7.1.2-30 (7.x line) and before 6.9.13-55 (6.x line) are affected, and the flaw is unauthenticated and remotely reachable per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) wherever untrusted image input is accepted, such as upload, conversion, or thumbnailing services; deployments that only process trusted local images face a much narrower exposure. Impact is confined to availability - there is no code execution, data disclosure, or integrity loss - and the vendor has shipped fixes in 7.1.2-30 and 6.9.13-55; no public exploit has been identified at time of analysis.
A crafted RSVG/SVG image can crash ImageMagick builds that lack Cairo support by forcing the RSVG decoder to free image state twice and then operate on freed memory (CWE-415 double free), yielding an availability-only denial of service rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw affects ImageMagick versions prior to 7.1.2-30 and 6.9.13-55 and is reachable by unauthenticated remote attackers who can get the application to process a malicious image, though exploitation requires the target to be a non-Cairo build and the image must actually trip an internal resource limit. Vendor fixes are published for both the 7.x and 6.x lines; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial-of-service in ImageMagick versions before 7.1.2-30 and 6.9.13-55 allows remote unauthenticated attackers to terminate an image-processing process by supplying a crafted image containing a deeply recursive XMP profile. The flaw only affects availability of the single ImageMagick task or worker-CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L-because the recursion limit is treated as a fatal error rather than a recoverable exception; there is no disclosure, corruption, or code execution. At time of analysis, no public exploit code or active exploitation was identified.
A missing security-policy enforcement check in ImageMagick's CUT image decoder allows a crafted CUT-format file to cause the library to open and read a companion '.PAL' palette file that an administrator's policy.xml explicitly restricts, resulting in limited information disclosure and a possible denial-of-service crash of the decoding process. The flaw affects ImageMagick versions prior to 7.1.2-31 (7.x branch) and prior to 6.9.13-56 (6.x branch), and exploitation requires a local decode operation - such as an upload-processing pipeline that runs 'convert', 'magick' or an application embedding the ImageMagick library - where a restrictive read policy is actually in place; on an unrestricted installation there is no policy to bypass and the security consequence is minimal. The issue is rated CVSS 3.1 4.0 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L), no privileges are required, attack complexity is high, and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a medium-to-low-priority issue: a genuine defence-in-depth control failure rather than a remotely reachable compromise vector.
ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56 can be induced to bypass a security policy configured with the 'coder' domain, allowing a crafted image to load a coder that the policy was meant to block and thereby read data that policy prohibits. The flaw matters only to deployments that actually configure a coder-based deny policy - typically security-conscious hosting, CI, or image-processing pipelines that pass untrusted user-supplied images into ImageMagick - where the bypass defeats the intended hardening and exposes file content to confidentiality loss. The CVSS base score is 6.2 with PR:N in the vector, so unauthenticated attackers can trigger it, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the fixing commits are public. Note a scoring discrepancy: NVD rates the vector AV:L while our independent assessment scores it AV:N, reflecting that such images are commonly delivered through remote upload pipelines.
ImageMagick versions prior to 7.1.2-31 (v7) and 6.9.13-56 (v6) contain a denial-of-service flaw in the MVG (Magick Vector Graphics) decoder where a crafted image can trigger an invalid memory free and crash the process. The issue requires the target to process an image with attacker-controlled MVG content (e.g., via an upload handler or conversion service); the HIGH attack complexity (AC:H) reflects that triggering the invalid free depends on specific primitive/coordinate conditions. The flaw is unauthenticated and remote (AV:N/PR:N) but causes only a process crash with no confidentiality or integrity impact; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and patched versions 7.1.2-31 and 6.9.13-56 are available.
Code injection in ImageMagick's PostScript and PDF output coders allows attacker-controlled text such as an image label to be written into generated PostScript/PDF output without escaping, so an injected PostScript operator can execute when that output is later rendered by an interpreter such as Ghostscript. Affected are ImageMagick 7.x before 7.1.2-31 and 6.x before 6.9.13-56; exploitation is not confirmed actively exploited (CISA KEV) and no public exploit code is identified at time of analysis. The assessed severity is medium (independent CVSS 5.3 / evaluated vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): the attack is remote and requires no authentication, but exploitation demands a high-complexity chain in which a conversion writes a label out through the ps, ps2, ps3, or pdf coder and the resulting file is subsequently rendered.
ImageMagick versions prior to 7.1.2-31 can be driven into excessive CPU consumption when the XMP profile parser resolves an attacker-supplied rational (numerator/denominator) value, degrading or stalling the service that performs the image conversion. The affected path is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but requires the application to feed attacker-controlled image data through ImageMagick, so the practical exposure is limited to upload, convert, or thumbnail pipelines that process untrusted images and read embedded XMP metadata. Impact is bounded to availability degradation - there is no memory corruption, data disclosure, or code execution - and no public exploit code was identified at time of analysis; the vendor has released ImageMagick 7.1.2-31 as the fix.
Repeated processing of crafted Magick scripts in ImageMagick versions prior to 7.1.2-31 leaks a file descriptor on each invocation, allowing unauthenticated remote attackers to exhaust a process's open-file-descriptor table and deny service to applications that exercise the MagickWand script-token (MSL/conjure) path. The issue is rated CVSS 5.3 with availability-only impact (C:N/I:N/A:L) and requires sustained or repeated request volume to be effective, since a single invocation is harmless and the leak is cleared by a process restart. No public exploit identified at time of analysis, and the vendor-released patch is version 7.1.2-31.
Heap buffer overflow in ImageMagick's distributed pixel cache (DPC) server (versions prior to 7.1.2-31) allows an unauthenticated adjacent-network attacker to crash the server by sending crafted pixel data that causes an integer overflow in the packet size calculation. Exploitation requires the target to run the opt-in DPC clustering feature, which is not enabled by default and is not reachable via normal image processing paths. No public exploit identified at time of analysis. This is a moderate availability-only issue (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H per independent assessment).
Unbounded MVG macro expansion in ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 lets a crafted Magick Vector Graphics image drive the MVG decoder into an excessively long-running render, degrading availability of any service that processes attacker-supplied MVG-capable content. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the issue is remotely reachable without authentication or user interaction, but impact is limited to partial availability loss with no confidentiality or integrity effect. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and EPSS data was not provided; the practical risk is tied mainly to whether a deployment actually renders untrusted MVG input. The vendor has released fixes in ImageMagick 7.1.2-31 and 6.9.13-56.
Uncontrolled recursion in ImageMagick's CALS decoder lets a crafted CALS image exhaust the call stack and terminate the decoding process, giving remote unauthenticated attackers a low-impact denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). All ImageMagick releases prior to 7.1.2-30 (7.x branch) and prior to 6.9.13-55 (6.x branch) are affected; the vulnerable code path is coders/cals.c (ReadCALSImage). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical reach is limited because the target must actually accept and decode the niche CALS Type 1 raster format rather than common JPEG/PNG inputs.
Integer overflow in ImageMagick's pixel-cache allocation path (GetVirtualPixels / SetPixelCacheNexusPixels) lets a locally supplied crafted call with attacker-controlled width, height, and channel/metacontent values overflow MagickSizeType arithmetic and write past a heap buffer, crashing the affected process. All ImageMagick releases prior to 6.9.13-56 (6.x line) and 7.1.2-31 (7.x line) are affected; the assessed CVSS is 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning impact is confined to a denial of service with no confidentiality or integrity loss and no demonstrated code execution. Exploitation is local and high-complexity because a precise overflow condition must be induced; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided in the available intelligence. Vendor-released patches exist in 6.9.13-56 and 7.1.2-31.
Denial of service in ImageMagick's distributed pixel cache (DPC) server before 7.1.2-32 allows an unauthenticated attacker on the same network segment to repeatedly open connections to the DPC listening socket and exhaust its available connection slots, degrading or halting distributed cache service on the host. The issue is limited to deployments that have explicitly enabled and network-exposed the DPC server - it is not part of default ImageMagick usage - and the assessed impact is availability-only (CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 4.3); no data disclosure or modification is possible. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), while the vendor-released fix is available in ImageMagick 7.1.2-32.
Denial of service in ImageMagick's Adobe Swatch Exchange (ASE) decoder allows a crafted ASE file to crash the process or trigger a long-running, resource-draining operation in all builds prior to 7.1.2-32. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) wherever an application passes untrusted image data to ImageMagick with the ASE coder enabled, but impact is limited to availability (C:N/I:N/A:L) with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch exists in 7.1.2-32, so the practical risk is moderate and primarily relevant to image-processing services, upload pipelines, and thumbnailers that accept arbitrary files.
Denial of service in ImageMagick caused by an infinite loop when parsing XMP metadata: a crafted XMP profile embedded in an image drives the internal XML entity parser into a non-terminating loop, so the image processing operation never completes and the worker thread or process burns CPU indefinitely. All builds prior to 7.1.2-32 (7.x line) and 6.9.13-57 (6.x line) are affected, including the many applications and language bindings that embed ImageMagick for thumbnail generation, upload validation, or media pipelines. The flaw is remotely triggerable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3) wherever an attacker-supplied image reaches an automated parser; impact is limited to availability (hang/resource exhaustion) with no memory corruption, data disclosure, or code execution, and no public exploit code was identified at time of analysis.
Denial of service in ImageMagick's PSD decoder occurs on 32-bit builds when processing a crafted PSD file with a malicious image resource block offset, causing an integer-conversion error that leads to an infinite loop. The vulnerability affects versions prior to 7.1.2-32 (ImageMagick 7) and 6.9.13-57 (ImageMagick 6), with unauthenticated remote attackers able to trigger it (CVSS vector PR:N) but requiring high attack complexity (AC:H) due to the 32-bit precondition and crafted file. No public exploit code or active exploitation has been identified, and the impact is confined to availability; 64-bit builds are not affected.
UNIX symlink-following in ImageMagick's delegate cleanup path allows a local, already-privileged workflow to overwrite a target file with random data. Affected are ImageMagick versions prior to 7.1.2-32 and the ImageMagick6 branch prior to 6.9.13-57; the flaw (CWE-61) causes the shred/cleanup routine to ignore the MAGICK_SHRED_PASSES setting, so it follows attacker-planted symbolic links instead of honoring the configured shred behavior. The attack surface is narrow - CVSS 3.1 scores this 4.0 (AV:L/AC:H/PR:H/UI:R) with integrity-only impact - and no public exploit has been identified at time of analysis; there is no CISA KEV designation.
Denial of service in ImageMagick before 7.1.2-32 (7.x line) and before 6.9.13-57 (legacy 6.x line): a missing end-of-file check in the bzip2 blob reader allows a crafted bzip2-compressed image whose stream is truncated or malformed to drive ReadBlob/EOFBlob into an infinite loop, exhausting processing resources and stalling any service that decodes untrusted image data. No authentication (PR:N) or user interaction (UI:N) is needed, but attack complexity is high (AC:H) because the malformed stream must be deliberately constructed to hit the vulnerable path, and impact is limited to availability (C:N/I:N/A:H) for an assessed CVSS of 5.9. No public exploit identified at time of analysis; the issue is addressed by the upstream commits and the 7.1.2-32 / 6.9.13-57 releases.
Denial of service in ImageMagick versions prior to 7.1.2-32 allows remote, unauthenticated attackers to crash the process by supplying a crafted EXR image that triggers a heap buffer overflow in the EXR decoder. The vulnerability requires an ImageMagick build with EXR/OpenEXR delegate support enabled and an application that passes attacker-controlled EXR files to it; the impact is limited to a single-process crash (low availability). No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 7.1.2-32.
ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57 silently discard the entire contents of a deployment's security policy when policy.xml carries a DOCTYPE declaration whose syntax does not end in ']>', so every restriction the administrator intended (e.g. blocking coders, delegates, or resource-heavy formats) is ignored and the previously forbidden operations succeed. Exploitation is local and privileged: the CVSS 4.0 vector scores it 1.8 (AV:L/AC:H/AT:P/PR:H/UI:N), meaning an actor with high privileges who can write or influence the privileged policy.xml file - or an administrator who authors a non-conforming DOCTYPE by accident - is the trigger, and the bug has no effect on default installations that ship no restrictive policy. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; vendor patches are available in 7.1.2-32 and 6.9.13-57, so this is assessed as a genuinely low-priority hardening issue rather than an urgent remote threat.
Uninitialized heap memory disclosure in ImageMagick's GIF decoder affects versions before 7.1.2-32 and 6.9.13-57. An unauthenticated remote attacker can supply a crafted GIF to a service that decodes images with a vulnerable ImageMagick, causing the application extension handler to read uninitialized heap bytes and store them as image metadata; if that metadata is returned or otherwise readable, sensitive heap contents may leak. The assessed impact is confidentiality-only and partial (VC:L) with high attack complexity (AC:H), and no public exploit has been identified at time of analysis; the vendor has released patches.
Memory-exhaustion denial of service in ImageMagick before 7.1.2-31 stems from the Ultra HDR (UHDR) encoder omitting resource-policy checks while allocating the pixel buffer, so a crafted UHDR image can push allocations past the memory/area/disk limits an operator configured in policy.xml. The flaw is remotely reachable without authentication (CVSS 4.0 vector PR:N/UI:N) in any application that routes untrusted images through ImageMagick's UHDR encoding path, but the independent assessment rates it low priority: AC:H and AT:P reflect a niche code path and a crafted image that must reliably defeat the policy logic, and impact is confined to availability (VC:N/VI:N/VA:L) with no confidentiality, integrity, or code-execution effect. Vendor patch 7.1.2-31 is available; no public exploit code and no confirmed active exploitation were identified at time of analysis.
A division-by-zero in ImageMagick's FLIF encoder allows unauthenticated remote attackers to crash the encoder process by supplying an image whose ticks-per-second field yields a zero divisor, causing a denial of service. Affected versions are ImageMagick before 7.1.2-31 (7.x) and before 6.9.13-56 (6.x); exploitation requires that a target application encode attacker-influenced data to FLIF, a relatively uncommon output format, and no public exploit code or active exploitation has been identified at time of analysis.
ImageMagick's PNM (Netpbm) image coder can be crashed via a NULL pointer dereference when processing a specially crafted or sufficiently large PNM image that pushes the library to its configured memory/resource limit at a specific allocation point where the failed allocation is never checked. The flaw affects ImageMagick releases before 7.1.2-31 on the 7.x branch and before 6.9.13-56 on the legacy 6.x branch, and the outcome is limited to a denial of service - a single-process crash that can be restarted - with no data exposure, integrity loss, or code execution. Severity is low (vendor CVSS 4.0 base 2.3; independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L with high attack complexity and partial prerequisite conditions), no public exploit code was identified at time of analysis, and a vendor-released patch is available.
Memory resource limits configured for ImageMagick are not enforced by the PCD coder (and, per the upstream advisory, the CUBE and HALD coders) when a specific command-line option is supplied, so a local user who can control ImageMagick invocation arguments can push the process past its intended policy limit and cause additional memory allocation. Impact is confined to limited availability degradation - no code execution, no data exposure, no integrity change - and the path is local-only with low privileges required (AV:L/PR:L in the assessed vector). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is rated low priority; vendor fixes 7.1.2-31 (7.x) and 6.9.13-56 (6.x) are available, and environments that invoke ImageMagick with fixed, non-user-controlled arguments are not exposed.
Memory corruption in ImageMagick's ImagesToBlob blob-conversion routine can crash an affected process on 7.x releases before 7.1.2-31 and 6.x releases before 6.9.13-56. The flaw is a use-after-free (CWE-416) in which a pointer is not updated correctly, and exploitation requires a crafted image to reach a local ImageMagick process or library call (CVSS 4.0 AV:L/AC:H/AT:P, PR:N), so no authentication is required but the attack surface is local and the trigger is difficult to satisfy reliably. Impact is confined to availability (VC:N/VI:N/VA:L) with no evidence of code execution or data exposure, and no public exploit identified at time of analysis; vendor patches are available.
Heap-use-after-free in ImageMagick's PerlMagick Layer method allows an attacker supplying a crafted list of images to trigger memory access after deallocation, causing a crash. Affected versions include ImageMagick before 7.1.2-30 and the 6.9.x branch before 6.9.13-55. Impact is limited to denial of service (crash); no confidentiality or integrity compromise is possible from this flaw. No public exploit code or active exploitation has been identified at time of analysis.
ImageMagick's video decoder contains a TOCTOU race condition that allows a local low-privileged attacker to bypass the policy.xml path write restrictions by swapping a symlink between the policy validation step and the actual file write operation. Both the ImageMagick 7 branch (before 7.1.2-30) and the legacy ImageMagick 6 branch (before 6.9.13-55) are affected, covering a wide range of deployed versions. No public exploit code exists and no active exploitation has been confirmed; the CVSS 4.0 score of 2.0 accurately reflects the local-access and race-condition constraints.
Heap-use-after-free in ImageMagick's PerlMagick Perl binding crashes the host process via a crafted call to the GetList method. Affected versions span the 6.9.x branch before 6.9.13-55 and the 7.x branch before 7.1.2-30. Impact is limited to denial of service (process crash); no confidentiality or integrity compromise has been demonstrated. No public exploit code or active exploitation is identified at time of analysis.
Path policy enforcement in ImageMagick before 7.1.2-30 on Windows can be circumvented by a local attacker exploiting a TOCTOU symlink race condition (CWE-59), granting unauthorized read or write access to files explicitly blocked by the ImageMagick policy.xml security configuration. The race window opens between the moment ImageMagick validates the symlink target against its policy and the subsequent actual filesystem I/O call, allowing an attacker to atomically swap the symlink to a policy-denied destination in that interval. No public exploit code is identified at time of analysis, CISA has not listed this in KEV, and the CVSS 4.0 base score of 1.0 accurately reflects the high attack complexity and constrained local-only vector.
Memory exhaustion in ImageMagick's MSL image decoder affects versions before 7.1.2-30 (v7 branch) and 6.9.13-55 (v6 branch), enabling unauthenticated network attackers to degrade or crash image-processing services by submitting crafted MSL files that trigger unbounded heap allocation without deallocation. The root cause (CWE-400, Uncontrolled Resource Consumption) lies in the MSL decoder's failure to free allocated memory on certain code paths, allowing cumulative heap exhaustion across repeated requests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.3 (Medium) reflects limited availability-only impact with elevated attack complexity.
Memory budget exhaustion in ImageMagick's OpenPixelCache allows remote unauthenticated attackers to cause a process-level denial of service by repeatedly triggering internal cache operation failures. Affected versions span both the 7.x branch (before 7.1.2-30) and the legacy 6.x branch (before 6.9.13-55), covering a large installed base of web services that process user-supplied images. The vulnerability stems from improper cleanup of memory accounting state on error paths, making the failure accumulative rather than self-correcting. No public exploit or CISA KEV listing has been identified at time of analysis.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Memory exhaustion in ImageMagick's magick CLI tool allows a local attacker to cause denial of service by repeatedly supplying malformed command-line arguments. Affects versions before 7.1.2-27. Vendor patch is available; no public exploit or active exploitation reported.
Memory leak in ImageMagick's TIFF encoder - affecting the 7.x branch before 7.1.2-26 and the 6.x branch before 6.9.13-51 - allows an attacker or application to cause gradual memory exhaustion by repeatedly supplying an invalid tiff:tile-geometry parameter during TIFF encoding operations. The flaw scores 2.0 under CVSS 4.0 with only low availability impact, a local attack vector, high complexity, and prerequisite conditions, placing it firmly in the low-severity tier. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis.
Memory leak in ImageMagick's ICON decoder exposes services that process user-supplied images to a potential denial of service. Both the 7.x and 6.x release branches are affected - specifically versions before 7.1.2-26 and 6.9.13-51 respectively. An unauthenticated remote attacker (per CVSS PR:N) who can supply a crafted ICON file to an ImageMagick-processing endpoint can repeatedly trigger allocation failures that are never cleaned up, gradually exhausting process memory. No public exploit or active exploitation has been identified at time of analysis.
Memory leak in ImageMagick's MIFF encoder (CWE-401) affects the 7.x branch before 7.1.2-26 and the 6.x branch before 6.9.13-51, enabling denial of service through resource exhaustion. When a memory allocation fails during MIFF image encoding, previously allocated buffers are not released, causing memory to accumulate across repeated processing calls. The CVSS 4.0 score of 2.1 and a local attack vector (AV:L) with high complexity (AC:H) and specific prerequisites (AT:P) signal a low-priority finding with no public exploit and no CISA KEV listing.
Memory leak in ImageMagick's YUV decoder (versions before 7.1.2-26 and 6.9.x before 6.9.13-51) enables remote denial of service by repeatedly submitting malformed YUV images that trigger a failed blob open, leaking heap memory on each decode attempt. No confidentiality or integrity impact applies; exposure is limited to availability of image-processing services that accept untrusted input. No public exploit code or active exploitation has been identified at time of analysis.