Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
158 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
- Target: ImageMagick (commit ecc9a5eb456747374bae8e07038ba10b3d8821b3) - Type: Undefined Behavior (function-type-mismatch) in splay tree cloning callback - Impact: Deterministic abort under UBSan (DoS in sanitizer builds). No crash in a non-sanitized build; likely low security impact. - Trigger: Minimal 2-byte input parsed via MagickWand, then coalescing. Environment OS: macOS (Apple Silicon/arm64) Homebrew clang version 20.1.8 Target: arm64-apple-darwin24.5.0 Thread model: posix InstalledDir: /opt/homebrew/Cellar/llvm/20.1.8/bin Configuration file: /opt/homebrew/etc/clang/arm64-apple-darwin24.cfg Homebrew ImageMagick: magick -version → ImageMagick 7.1.2-0 Q16-HDRI aarch64 pkg-config: MagickWand-7.Q16HDRI version 7.1.2 Library configure flags (capsule build): ./configure --disable-shared --enable-static --without-modules --without-magick-plus-plus --disable-openmp --without-perl --without-x --with-png=yes --without-jpeg --without-tiff --without-xml --without-lqr…
Recommended action: Upgrade to 14.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details The magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. The source snippet below is heavily abbreviated due to the size of the function, but hopefully the important points are captured. If we look at the calculation for magnifiedwidth, we can see that we are storing the results in a pnguint32. The operations at \[0\] and \[1\] are safe, since mnginfo-magnml and mnginfo-magnmx are both 16-bit unsigned integers, but both the multiplication at \[2\] and the addition of the result of that multiplication to magnifiedwidth can overflow, leading to a value of magnifiedwidth that is smaller than required. When we then operate on the pixel buffers, we use the original parameters for the magnification, and we assume (reasonably?) that the output buffer is larger than the input buffer when calculating where to write the upsampled/magnified pixel values. Unfortunately, after the overflow has happened,…
Recommended action: Upgrade to 14.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details When performing image magnification in ReadOneMNGIMage (in coders/png.c), there is an issue around the handling of images with separate alpha channels. When loading an image with a color type that implies a separate alpha channel (ie. jngcolortype = 12), we will load the alpha pixels in this loop: Note that at \[1\] we update image-alphatrait, but if our alpha image only contains non-opaque pixels in the last row, we do not call GetAuthenticPixels (at \[0\]) after this change has been made. The next call to GetAuthenticPixels will then call down into ResetPixelChannelMap which adds the new alpha channel to the image channel mappings and metadata. If we then pass this image into the MAGN chunk type, we can see that at \[2\] we calculate the sizes for intermediate buffers next and prev, before calling GetAuthenticPixels at \[4\]. After the call at \[4\], the image-numchannels has increased to include the new alpha channel, and now length and the previously…
Recommended action: Upgrade to 14.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
While Processing a crafted TIFF file, imagemagick crashes. Details Following is the imagemagick version: PoC issue can be replicated with following command with provided POC file(sent over email): Impact This can lead to application crash. Credits Please give credits to Hardik shah of Vehere (Dawn Treaders team)
Recommended action: Upgrade to 13.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In ImageMagick's magick stream command, specifying multiple consecutive %d format specifiers in a filename template causes a memory leak. Details - Vulnerability Type: Memory leak - Affected Version: ImageMagick 7.1.1-47 (as of commit 82572afc, June 2025) Reproduction Tested Environment - Operating System: Ubuntu 22.04 LTS - Architecture: x8664 - Compiler: gcc with AddressSanitizer (gcc version: 11.4.0) Reproduction Steps Output Commits Fixed in https://github.com/ImageMagick/ImageMagick/commit/fc3ab0812edef903bbb2473c0ee652ddfd04fe5c and https://github.com/ImageMagick/ImageMagick6/commit/d49460522669232159c2269fa64f73ed30555c1b
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Heap Buffer Overflow in InterpretImageFilename Summary A heap buffer overflow was identified in the InterpretImageFilename function of ImageMagick. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (%%). Environment - OS: Arch Linux (Linux gmkhost 6.14.2-arch1-1 1 SMP PREEMPTDYNAMIC Thu, 10 Apr 2025 18:43:59 +0000 x8664 GNU/Linux (GNU libc) 2.41) - Architecture: x8664 - Compiler: gcc (GCC) 15.1.1 20250425 Reproduction Build Instructions Minimum Trigger Crash Analysis AddressSanitizer Output Root Cause Analysis The first command line argument is interpreted as MagickImageCommand: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/utilities/magick.c#L83 It is invoked here: https://github.com/ImageMagick/ImageMagick/blob/8fff9b4f44d2e8b5cae2bd6db70930a144d15f12/MagickWand/magick-cli.c#L220 The execution then follows this path: -…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Hi, we have found a stack buffer overflow and would like to report this issue. Could you confirm if this qualifies as a security vulnerability? I am happy to provide any additional information needed. Summary In ImageMagick's magick mogrify command, specifying multiple consecutive %d format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through vsnprintf(). Additional information Upon further investigation, we found that the same issue occurs not only with mogrify but also with the following subcommands: compare, composite, conjure, convert, identify, mogrify, and montage. Furthermore, we confirmed that this vulnerability has the potential to lead to RCE. RCE is possible when ASLR is disabled and there is a suitable onegadget in libc, provided that options and filenames can be controlled. Details - Vulnerability Type: CWE-124: Buffer Underwrite - Affected Component:…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Infinite lines occur when writing during a specific XMP file conversion command Details In this code, the loop while(fabs(df - value) MagickEpsilon) keeps repeating endlessly. PoC magick hang a.mng https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing Impact XMP profile write triggers hang due to unbounded loop credits Team Pay1oad DVE Reporter : Shinyoung Won (with contributions from WooJin Park, DongHa Lee, JungWoo Park, Woojin Jeon, Juwon Chae, Kyusang Han, JaeHun Gou) yosimich(@yosiimich) Shinyoung Won of SSA Lab e-mail : [yosimich123@gmail.com] Woojin Jeon Gtihub : brainoverflow e-mail : [root@brainoverflow.kr] WooJin Park GitHub : jin-156 e-mail : [1203kids@gmail.com] Who4mI(@GAP-dev) Lee DongHa of SSA Lab Github: GAP-dev e-mail : [ceo@zeropointer.co.kr] JungWoo Park Github : JungWooJJING e-mail : [cuby5577@gmail.com] Juwon Chae Github : Imho e-mail : [wndnjs4698@naver.com] Kyusang Han Github : T1deSEC e-mail : [hksjoe0081@gmail.com] JaeHun…
Recommended action: Upgrade to 14.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.