ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to ReadBlobMSBLong function calls.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade imagemagickUpgrade graphicsmagick | Jul 30, 2024 | Sep 24, 2007 |
| Freebsd | — | Upgrade ImageMagickUpgrade ImageMagick-nox11 | Dec 10, 2025 | Oct 10, 2007 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Oct 30, 2017 | Sep 24, 2007 |
| Oracle_linux | — | Upgrade ImageMagickUpgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade ImageMagick-develUpgrade ImageMagick-c++-devel | Oct 16, 2024 | Sep 24, 2007 |
| Suse | — | Upgrade ImageMagick-develUpgrade libMagickCore1Upgrade libMagickCore-7_Q16HDRI10Upgrade libMagick++1Upgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-config-7-upstream-websafeUpgrade ImageMagick-extraUpgrade libMagickWand-7_Q16HDRI10Upgrade ImageMagick-config-7-upstream-openUpgrade libMagickCore1-32bitUpgrade ImageMagickUpgrade libMagick++-develUpgrade ImageMagick-config-7-upstream-secureUpgrade libMagick++-7_Q16HDRI5Upgrade ImageMagick-docUpgrade libMagickWand1-32bitUpgrade GraphicsMagickUpgrade perl-GraphicsMagickUpgrade libGraphicsMagick2Upgrade perl-PerlMagickUpgrade libMagickWand1Upgrade ImageMagick-config-7-upstream-limited | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libmagick9 | Nov 8, 2024 | Sep 24, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub