Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
165 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Using Magick to read a malicious SVG file resulted in a DoS attack. Details bt obtained using gdb: This is related to the SVGStartElement and ResizeQuantumMemory functions. PoC 1. Generate an SVG file 2. Read this file using Magick: 3. Causes a DoS Attack My server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example: The error code -1073741571 indicates a crash due to a stack overflow. Impact This is a DoS vulnerability and all applications using Magick to parse SVG files are affected.
Recommended action: Upgrade to 14.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The TIM (PSX TIM) image parser in ImageMagick contains a critical integer overflow vulnerability in the ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates imagesize = 2 width height without checking for overflow. On 32-bit systems (or where sizet is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. Vulnerable Code File: coders/tim.c Impact This vulnerability can lead to Arbitrary Memory Disclosure due to an out of bounds read on 32-bit systems.
Recommended action: Upgrade to 14.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CVE-2025-57803 claims to be patched in ImageMagick 7.1.2-2, but the fix is incomplete and ineffective. The latest version 7.1.2-5 remains vulnerable to the same integer overflow attack. The patch added BMPOverflowCheck() but placed it after the overflow occurs, making it useless. A malicious 58-byte BMP file can trigger AddressSanitizer crashes and DoS. Affected Versions: - ImageMagick < 7.1.2-2 (originally reported) - ImageMagick 7.1.2-2 through 7.1.2-5 (incomplete patch) Platform and Configuration Requirements: - 32-bit systems ONLY (i386, i686, armv7l, etc.) - Requires sizet = 4 bytes. (64-bit systems are NOT vulnerable (sizet = 8 bytes)) - Requires modified resource limits: The default width, height, and area limits must have been manually increased (Systems using default ImageMagick resource limits are NOT vulnerable). --- Details(Root Cause Analysis) Vulnerable Code Location File: coders/bmp.c Lines: 1120-1122 (in version 7.1.2-5) The Incomplete Patch Why the Patch…
Recommended action: Upgrade to 14.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytesperline (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. - Impact: Attacker-controlled heap out-of-bounds (OOB) write during conversion to BMP. - Surface: Typical upload → normalize/thumbnail → magick ... out.bmp workers. - 32-bit: Vulnerable (reproduced with ASan). - 64-bit: Safe from this specific integer overflow (IOF) by arithmetic, but still add product/size guards. - Proposed severity: Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). --- Scope & Affected Builds - Project: ImageMagick (BMP writer path, WriteBMPImage in coders/bmp.c). - Commit under test:…
Recommended action: Upgrade to 14.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. <br Details root cause When the InterpretImageFilename function processes a filename beginning with format specifiers such as %d, %o, or %x, the filename string is directly passed as a parameter to the FormatLocaleString function. <br Inside FormatLocaleString, the variable argument list is initialized through vastart, after which the format string processing occurs by interpreting the format specifiers and using corresponding values from CPU registers and the call stack as arguments for the formatting operations. <br PoC 1. Heap overflow read tested on development container Processing a malicious filename containing format string specifiers such as %d%n results in corruption of the…
Recommended action: Upgrade to 14.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. Details Root Cause 1. montage -geometry ":" ... reaches MagickCore/geometry.c:GetGeometry(). 2. StringToDouble/InterpretLocaleValue parses ":" as 0.0; then: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355 WidthValue (and/or HeightValue) is set with a zero dimension. 3. In MagickCore/resize.c:ThumbnailImage(), the code computes: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629 causing a division by zero and immediate crash. The issue is trivially triggerable without external input files (e.g., using xc:white). Reproduction Environment Steps Observed result PoC No external file required; the…
Recommended action: Upgrade to 14.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
- Target: ImageMagick (commit ecc9a5eb456747374bae8e07038ba10b3d8821b3) - Type: Undefined Behavior (function-type-mismatch) in splay tree cloning callback - Impact: Deterministic abort under UBSan (DoS in sanitizer builds). No crash in a non-sanitized build; likely low security impact. - Trigger: Minimal 2-byte input parsed via MagickWand, then coalescing. Environment OS: macOS (Apple Silicon/arm64) Homebrew clang version 20.1.8 Target: arm64-apple-darwin24.5.0 Thread model: posix InstalledDir: /opt/homebrew/Cellar/llvm/20.1.8/bin Configuration file: /opt/homebrew/etc/clang/arm64-apple-darwin24.cfg Homebrew ImageMagick: magick -version → ImageMagick 7.1.2-0 Q16-HDRI aarch64 pkg-config: MagickWand-7.Q16HDRI version 7.1.2 Library configure flags (capsule build): ./configure --disable-shared --enable-static --without-modules --without-magick-plus-plus --disable-openmp --without-perl --without-x --with-png=yes --without-jpeg --without-tiff --without-xml --without-lqr…
Recommended action: Upgrade to 14.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details The magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. The source snippet below is heavily abbreviated due to the size of the function, but hopefully the important points are captured. If we look at the calculation for magnifiedwidth, we can see that we are storing the results in a pnguint32. The operations at \[0\] and \[1\] are safe, since mnginfo-magnml and mnginfo-magnmx are both 16-bit unsigned integers, but both the multiplication at \[2\] and the addition of the result of that multiplication to magnifiedwidth can overflow, leading to a value of magnifiedwidth that is smaller than required. When we then operate on the pixel buffers, we use the original parameters for the magnification, and we assume (reasonably?) that the output buffer is larger than the input buffer when calculating where to write the upsampled/magnified pixel values. Unfortunately, after the overflow has happened,…
Recommended action: Upgrade to 14.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details When performing image magnification in ReadOneMNGIMage (in coders/png.c), there is an issue around the handling of images with separate alpha channels. When loading an image with a color type that implies a separate alpha channel (ie. jngcolortype = 12), we will load the alpha pixels in this loop: Note that at \[1\] we update image-alphatrait, but if our alpha image only contains non-opaque pixels in the last row, we do not call GetAuthenticPixels (at \[0\]) after this change has been made. The next call to GetAuthenticPixels will then call down into ResetPixelChannelMap which adds the new alpha channel to the image channel mappings and metadata. If we then pass this image into the MAGN chunk type, we can see that at \[2\] we calculate the sizes for intermediate buffers next and prev, before calling GetAuthenticPixels at \[4\]. After the call at \[4\], the image-numchannels has increased to include the new alpha channel, and now length and the previously…
Recommended action: Upgrade to 14.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
While Processing a crafted TIFF file, imagemagick crashes. Details Following is the imagemagick version: PoC issue can be replicated with following command with provided POC file(sent over email): Impact This can lead to application crash. Credits Please give credits to Hardik shah of Vehere (Dawn Treaders team)
Recommended action: Upgrade to 13.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Details - Vulnerability Type: Memory leak - Affected Version: ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025) Reproduction Tested Environment - Operating System: Ubuntu 22.04 LTS - Architecture: x8664 - Compiler: gcc with AddressSanitizer (gcc version: 11.4.0) Reproduction Steps Output Commits Fixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap Buffer Overflow in InterpretImageFilename Summary A heap buffer overflow was identified in the InterpretImageFilename function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (%%). Environment - OS: Arch Linux (Linux gmkhost 6.14.2-arch1-1 1 SMP PREEMPTDYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x8664 GNU/Linux (GNU libc) 2.41) - Architecture: x8664 - Compiler: gcc (GCC) 15.1.1 20250425 Reproduction Build Instructions Minimum Trigger Crash Analysis AddressSanitizer Output Root Cause Analysis The first command line argument is interpreted as MagickImageCommand: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/utilities/magick.c#L83 It is invoked here: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L220 The execution then follows this path: -…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Hi, we have found a stack buffer overflow and would like to report this issue. Could you confirm if this qualifies as a security vulnerability? I am happy to provide any additional information needed. Summary In ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through vsnprintf(). Additional information Upon further investigation, we found that the same issue occurs not only with mogrify but also with the following subcommands: compare, composite, conjure, convert, identify, mogrify, and montage. Furthermore, we confirmed that this vulnerability has the potential to lead to RCE. RCE is possible when ASLR is disabled and there is a suitable onegadget in libc, provided that options and filenames can be controlled. Details - Vulnerability Type: CWE-124: Buffer Underwrite - Affected Component:…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Infinite lines occur when writing during a specific XMP file conversion command Details In this code, the loop while(fabs(df - value) MagickEpsilon) keeps repeating endlessly. PoC magick hang a.mng https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing Impact XMP profile write triggers hang due to unbounded loop credits Team Pay1oad DVE Reporter : Shinyoung Won (with contributions from WooJin Park, DongHa Lee, JungWoo Park, Woojin Jeon, Juwon Chae, Kyusang Han, JaeHun Gou) yosimich(@yosiimich) Shinyoung Won of SSA Lab e-mail : [yosimich123@gmail.com] Woojin Jeon Gtihub : brainoverflow e-mail : [root@brainoverflow.kr] WooJin Park GitHub : jin-156 e-mail : [1203kids@gmail.com] Who4mI(@GAP-dev) Lee DongHa of SSA Lab Github: GAP-dev e-mail : [ceo@zeropointer.co.kr] JungWoo Park Github : JungWooJJING e-mail : [cuby5577@gmail.com] Juwon Chae Github : Imho e-mail : [wndnjs4698@naver.com] Kyusang Han Github : T1deSEC e-mail : [hksjoe0081@gmail.com] JaeHun…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Recommended action: Upgrade to 13.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.