Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Published: 2026-07-01
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A specially crafted 8BIM profile can cause a use‑after‑free in ImageMagick’s image identification routine. The flaw results in the program dereferencing memory that has already been freed, leading to memory corruption in the running process.

Affected Systems

All ImageMagick releases prior to 6.9.13‑51 and to 7.1.2‑26 are affected. Any installation that performs image identification on user‑supplied or processed images is susceptible, independent of the operating system or distribution platform.

Risk and Exploitability

The CVSS score of 5.5 classifies the vulnerability as medium risk. An EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of widespread exploitation at the time of this analysis. The attack likely requires an attacker to supply a tailored image containing a malicious 8BIM profile to a vulnerable application, which is a non‑trivial yet feasible vector if image processing is performed on untrusted data.

Generated by OpenCVE AI on July 22, 2026 at 14:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to ImageMagick 6.9.13‑51 or newer, or 7.1.2‑26 or newer, which contain the fix.
  • Validate or sanitize image inputs to remove or reject malformed 8BIM profiles before they reach ImageMagick, following CWE-825 guidelines.
  • Run image‑processing workflows in a sandboxed or isolated environment, such as containers or restricted users.

Generated by OpenCVE AI on July 22, 2026 at 14:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 02 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Imagemagick
Imagemagick imagemagick
Vendors & Products Imagemagick
Imagemagick imagemagick

Wed, 01 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Description ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.
Title ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Imagemagick Imagemagick
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-01T19:21:37.355Z

Reserved: 2026-06-16T22:44:22.283Z

Link: CVE-2026-55510

cve-icon Vulnrichment

Updated: 2026-07-01T19:21:33.945Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-01T18:53:58Z

Links: CVE-2026-55510 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T14:15:02Z

Weaknesses