Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade graphicsmagickUpgrade imagemagick | Jul 30, 2024 | Sep 24, 2007 |
| Freebsd | — | Upgrade ImageMagickUpgrade ImageMagick-nox11 | Dec 10, 2025 | Oct 10, 2007 |
| Gentoo Linux | — | Upgrade media-gfx/imagemagick. | Oct 30, 2017 | Sep 24, 2007 |
| Oracle_linux | — | Upgrade ImageMagick-perlUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade ImageMagickUpgrade ImageMagick-devel | Oct 16, 2024 | Sep 24, 2007 |
| Suse | — | Upgrade libMagickCore1Upgrade libMagickWand1-32bitUpgrade ImageMagick-docUpgrade ImageMagick-config-7-upstream-secureUpgrade libMagickWand1Upgrade libMagickCore1-32bitUpgrade GraphicsMagickUpgrade ImageMagick-config-7-SUSEUpgrade ImageMagick-config-7-upstream-websafeUpgrade libMagick++-7_Q16HDRI5Upgrade libMagick++1Upgrade perl-GraphicsMagickUpgrade libMagickWand-7_Q16HDRI10Upgrade ImageMagick-config-7-upstream-openUpgrade libGraphicsMagick2Upgrade ImageMagick-extraUpgrade ImageMagick-config-7-upstream-limitedUpgrade perl-PerlMagickUpgrade libMagickCore-7_Q16HDRI10Upgrade ImageMagickUpgrade ImageMagick-develUpgrade libMagick++-devel | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libmagick9 | Nov 8, 2024 | Sep 24, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub