Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
162 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A crafted MSL script triggers a heap-use-after-free. The operation element handler replaces and frees the image while the parser continues reading from it, leading to a UAF in ReadBlobString during further parsing.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Memory leak exists in coders/ashlar.c. The WriteASHLARImage allocates a structure. However, when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak. bash ==78968== Memcheck, a memory error detector ==78968== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al. ==78968== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info ==78968== ==78968== HEAP SUMMARY: ==78968== in use at exit: 17,232 bytes in 4 blocks ==78968== total heap usage: 4,781 allocs, 4,777 frees, 785,472 bytes allocated
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stack-based buffer overflow exists in the ImageMagick FTXT image reader. A crafted FTXT file can cause out-of-bounds writes on the stack, leading to a crash.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The shipped “secure” security policy includes a rule intended to prevent reading/writing from standard streams: However, ImageMagick also supports fd:<n pseudo-filenames (e.g., fd:0, fd:1). This path form is not blocked by the secure policy templates, and therefore bypasses the protection goal of “no stdin/stdout”. To resolve this, users can add the following change to their security policy. And this will also be included in ImageMagick's more secure policies by default.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/ can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken. But it make sure writing is also not possible the following should be added to your policy: And this will also be included in the project's more secure policies by default.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The UIL and XPM image encoder do not validate the pixel index value returned by GetPixelIndex() before using it as an array subscript. In HDRI builds, Quantum is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An Integer Overflow vulnerability exists in the sun decoder. On 32-bit systems/builds, a carefully crafted image can lead to an out of bounds heap write.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ps encoders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a malicious file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In ReadSTEGANOImage() (coders/stegano.c), the watermark Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In ReadSFWImage() (coders/sfw.c), when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
WriteUHDRImage in coders/uhdr.c uses int arithmetic to compute the pixel buffer size. When image dimensions are large, the multiplication overflows 32-bit int, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When a PCD file does not contain a valid marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When processing a maliciously crafted PSD file containing ZIP-compressed layer data that decompresses to less than the expected size, uninitialized heap memory is leaked into the output image. Expected Impact Information disclosure leading to potential exposure of sensitive data from server memory.
Recommended action: Upgrade to 14.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
NULL pointer dereference in MSL (Magick Scripting Language) parser when processing <comment tag before any image is loaded. Version - ImageMagick 7.x (tested on current main branch) - Commit: HEAD Steps to Reproduce Method 1: Using ImageMagick directly Method 2: Using OSS-Fuzz reproduce Or run the fuzzer directly: Expected Behavior ImageMagick should handle the malformed MSL gracefully and return an error message. Actual Behavior Root Cause Analysis In coders/msl.c:7091, MSLEndElement() calls DeleteImageProperty() on mslinfo-image[n] when handling the </comment end tag without checking if the image is NULL: When <comment appears before any <read operation, mslinfo-image[n] is NULL, causing the assertion failure in DeleteImageProperty() at property.c:297. Impact - DoS: Crash via assertion failure (debug builds) or NULL pointer dereference (release builds) - Affected: Any application using ImageMagick to process user-supplied MSL files Fuzzer This issue was discovered using a…
Recommended action: Upgrade to 14.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A memory leak vulnerability exists in the LoadOpenCLDeviceBenchmark() function in MagickCore/opencl.c. When parsing a malformed OpenCL device profile XML file that contains <device elements without proper / closing tags, the function fails to release allocated memory for string members (platformname, vendorname, name, version), leading to memory leaks that could result in resource exhaustion. Affected Version: ImageMagick 7.1.2-12 and possibly earlier versions --- Details The vulnerability is located in MagickCore/opencl.c, function LoadOpenCLDeviceBenchmark() (lines 754-911). Root Cause Analysis: 1. When a <device tag is encountered, a MagickCLDeviceBenchmark structure is allocated (line 807-812) 2. String attributes (platform, vendor, name, version) are allocated via ConstantString() (lines 878, 885, 898, 900) 3. These strings are only freed when a / closing tag is encountered (lines 840-849) 4. At function exit (lines 908-910), only the devicebenchmark structure is freed,…
Recommended action: Upgrade to 14.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stack overflow via infinite recursion in MSL (Magick Scripting Language) <write command when writing to MSL format. Version - ImageMagick 7.x (tested on current main branch) - Commit: HEAD - Requires: libxml2 support (for MSL parsing) Steps to Reproduce Method 1: Using ImageMagick directly Method 2: Using OSS-Fuzz reproduce Or run the fuzzer directly: Expected Behavior ImageMagick should handle recursive MSL references gracefully by detecting the loop and returning an error. Actual Behavior Stack overflow causes process crash: Root Cause Analysis In coders/msl.c, the <write command handler in MSLStartElement() (line ~7045) calls WriteImage(). When the output filename specifies MSL format (msl:filename), WriteMSLImage() is called, which parses the MSL file again via ProcessMSLScript(). If the MSL file references itself (directly or indirectly), this creates an infinite recursion loop: Impact - DoS: Guaranteed crash via stack exhaustion - Affected: Any application using…
Recommended action: Upgrade to 14.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But the last element in the set is not properly initialized. This will result in a release of an invalid pointer inside DestroyBilateralTLS when the memory allocation fails.
Recommended action: Upgrade to 14.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Magick fails to check for circular references between two MVGs, leading to a stack overflow. Details After reading mvg1 using Magick, the following is displayed: Impact This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.
Recommended action: Upgrade to 14.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Using Magick to read a malicious SVG file resulted in a DoS attack. Details bt obtained using gdb: This is related to the SVGStartElement and ResizeQuantumMemory functions. PoC 1. Generate an SVG file 2. Read this file using Magick: 3. Causes a DoS Attack My server has a large amount of memory, causing a stack overflow to take a long time. I'll use the Windows release version as an example: The error code -1073741571 indicates a crash due to a stack overflow. Impact This is a DoS vulnerability and all applications using Magick to parse SVG files are affected.
Recommended action: Upgrade to 14.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The TIM (PSX TIM) image parser in ImageMagick contains a critical integer overflow vulnerability in the ReadTIMImage function (coders/tim.c). The code reads width and height (16-bit values) from the file header and calculates imagesize = 2 width height without checking for overflow. On 32-bit systems (or where sizet is 32-bit), this calculation can overflow if width and height are large (e.g., 65535), wrapping around to a small value. This results in a small heap allocation via AcquireQuantumMemory and later operations relying on the dimensions can trigger an out of bounds read. Vulnerable Code File: coders/tim.c Impact This vulnerability can lead to Arbitrary Memory Disclosure due to an out of bounds read on 32-bit systems.
Recommended action: Upgrade to 14.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.