ImageMagick Can Crash or Leak Sensitive Data

Summary

Old versions of ImageMagick can crash or leak sensitive data when processing certain image files. This is a security risk because it could allow an attacker to access sensitive information or take control of your system. Update to version 7.1.2-15 or 6.9.13-40 to fix this issue.

What to do

Update debian imagemagick to version 8:7.1.1.43+dfsg1-1+deb13u6.
Update debian imagemagick to version 8:7.1.2.15+dfsg1-1.

Affected software

Vendor	Product	Affected versions	Fix available
debian	imagemagick	All versions	–
debian	imagemagick	All versions	–
debian	imagemagick	<= 8:7.1.1.43+dfsg1-1+deb13u6	8:7.1.1.43+dfsg1-1+deb13u6
debian	imagemagick	<= 8:7.1.2.15+dfsg1-1	8:7.1.2.15+dfsg1-1

Original title

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel inde...

Original description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the UIL and XPM image encoder do not validate the pixel index value returned by `GetPixelIndex()` before using it as an array subscript. In HDRI builds, `Quantum` is a floating-point type, so pixel index values can be negative. An attacker can craft an image with negative pixel index values to trigger a global buffer overflow read during conversion, leading to information disclosure or a process crash. Versions 7.1.2-15 and 6.9.13-40 contain a patch.

osv CVSS3.1 9.1

https://security-tracker.debian.org/tracker/CVE-2026-25898 Vendor Advisory