ImageMagick: Large image processing can crash or corrupt data

Summary

Large image files can cause ImageMagick to crash or write data outside its memory boundaries, potentially leading to data corruption. This issue was fixed in version 7.1.2-15. Update to the latest version to fix this problem.

What to do

Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u6.
Update debian imagemagick to version 8:7.1.2.15+dfsg1-1.

Affected software

Vendor	Product	Affected versions	Fix available
debian	imagemagick	<= 8:7.1.1.43+dfsg1-1+deb13u6	8:7.1.1.43+dfsg1-1+deb13u6
debian	imagemagick	<= 8:7.1.2.15+dfsg1-1	8:7.1.2.15+dfsg1-1

Original title

ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to v...

Original description

ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch.

osv CVSS3.1 8.2

https://security-tracker.debian.org/tracker/CVE-2026-25794 Vendor Advisory