Read the docs
TI-2026-66578 Aliases GHSA-8vfj-q2cp-5m5j

ImageMagick has a heap buffer overflow read in magnify operation via unrecognized magnify:method value

Priority LOW 38CWE-122Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

An unrecognized magnify:method will result in an out of bounds read in the magnify operation. ``` ==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000b30 READ of size 4 at 0x61a000000b30 thread T0 ```

Why it matters now

Fix Fixed Magick.NET-Q16-AnyCPU (NuGet): 14.12.0Magick.NET-Q16-HDRI-AnyCPU (NuGet): 14.12.0+16 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Magick.NET-Q16-AnyCPU (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-HDRI-AnyCPU (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-HDRI-arm64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-HDRI-x64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-HDRI-x86 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-OpenMP-arm64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-OpenMP-x64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-arm64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-x64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-x86 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q8-AnyCPU (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q8-OpenMP-arm64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q8-OpenMP-x64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q8-arm64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q8-x64 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
—Magick.NET-Q8-x86 (NuGet)before 14.12.014.12.0Patch availableGHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-AnyCPU (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-HDRI-AnyCPU (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-HDRI-arm64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-HDRI-x64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-HDRI-x86 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-OpenMP-arm64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-OpenMP-x64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-arm64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-x64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-x86 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q8-AnyCPU (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q8-OpenMP-arm64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q8-OpenMP-x64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q8-arm64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q8-x64 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j
  • Magick.NET-Q8-x86 (NuGet) Vendor— Affected before 14.12.0 Fixed in 14.12.0 Patch available GHSA-8vfj-q2cp-5m5j

Remediation

  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-AnyCPU (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-HDRI-AnyCPU (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-HDRI-arm64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-HDRI-x64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-HDRI-x86 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-OpenMP-arm64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-OpenMP-x64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-arm64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-x64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-x86 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q8-AnyCPU (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q8-OpenMP-arm64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q8-OpenMP-x64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q8-arm64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q8-x64 (NuGet) Fixed in 14.12.0 Advisory →
  • Fix · GHSA-8vfj-q2cp-5m5j Magick.NET-Q8-x86 (NuGet) Fixed in 14.12.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-8vfj-q2cp-5m5j

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences