GHSA-qh5g-q395-cx4j CVE-2026-61857
ImageMagick: Heap-use-after-free via XMP profile could result in a crash
Medium
NuGet
- Severity
- 6.3 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.27%
- Chance of exploitation in the next 30 days. Higher than 18.54% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-252 Unchecked Return Value
- CWE-400 Uncontrolled Resource Consumption
- CWE-416 Use After Free
- CWE-476 NULL Pointer Dereference
- CWE-703 Improper Check or Handling of Exceptional Conditions
- Fix
- Available
- 17 packages have a fixed version
Description
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Affected versions
NuGet
| Package | Vulnerable | Fixed in |
|---|---|---|
| Magick.NET-Q16-AnyCPU | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-HDRI-AnyCPU | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-HDRI-OpenMP-arm64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-HDRI-arm64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-HDRI-x64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-HDRI-x86 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-OpenMP-arm64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-OpenMP-x64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-arm64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-x64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q16-x86 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q8-AnyCPU | < 14.15.0 |
14.15.0 |
| Magick.NET-Q8-OpenMP-arm64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q8-OpenMP-x64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q8-arm64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q8-x64 | < 14.15.0 |
14.15.0 |
| Magick.NET-Q8-x86 | < 14.15.0 |
14.15.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
Magick.NET-Q16-AnyCPU NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-AnyCPU --version 14.15.0
Magick.NET-Q16-HDRI-AnyCPU NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-HDRI-AnyCPU --version 14.15.0
Magick.NET-Q16-HDRI-OpenMP-arm64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-HDRI-OpenMP-arm64 --version 14.15.0
Magick.NET-Q16-HDRI-arm64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-HDRI-arm64 --version 14.15.0
Magick.NET-Q16-HDRI-x64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-HDRI-x64 --version 14.15.0
Magick.NET-Q16-HDRI-x86 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-HDRI-x86 --version 14.15.0
Magick.NET-Q16-OpenMP-arm64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-OpenMP-arm64 --version 14.15.0
Magick.NET-Q16-OpenMP-x64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-OpenMP-x64 --version 14.15.0
Magick.NET-Q16-arm64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-arm64 --version 14.15.0
Magick.NET-Q16-x64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-x64 --version 14.15.0
Magick.NET-Q16-x86 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q16-x86 --version 14.15.0
Magick.NET-Q8-AnyCPU NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q8-AnyCPU --version 14.15.0
Magick.NET-Q8-OpenMP-arm64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q8-OpenMP-arm64 --version 14.15.0
Magick.NET-Q8-OpenMP-x64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q8-OpenMP-x64 --version 14.15.0
Magick.NET-Q8-arm64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q8-arm64 --version 14.15.0
Magick.NET-Q8-x64 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q8-x64 --version 14.15.0
Magick.NET-Q8-x86 NuGet → 14.15.0
- dotnet
dotnet add package Magick.NET-Q8-x86 --version 14.15.0
Severity breakdown
CVSS 4.0 6.3
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How to prevent it
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Implementation: Ensure that you account for all possible return values from the function.
- Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
How to prevent it
- Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
- Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
- Implementation: Ensure that all failures in resource allocation place the system into a safe posture.
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
How to prevent it
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Requirements: Select a programming language that is not susceptible to these issues.
- Implementation: Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
- Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
- Implementation: Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
CWE-703: Improper Check or Handling of Exceptional Conditions
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable | High Known exploited | Also affects magick.net-q16-anycpu |
| GHSA-cvhv-g4rq-3hmw ImageMagick: Memory Leak when providing invalid options to the cli | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-h22j-f9xw-xjjm ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-422r-8c97-xcg4 ImageMagick: Heap Buffer Over-Write in fx operation | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-f5m7-cqgw-8hm7 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-hc76-7mpc-qjqh ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797 | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-56m6-8q75-f2rw ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219 | Medium | Also affects Magick.NET-Q16-AnyCPU |
| GHSA-h5r4-w88w-7ccr ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified | Low | Also affects Magick.NET-Q16-AnyCPU |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor