PT-2026-76315 · Julia · Imagemagick Jll

Published

2026-07-30

·

Updated

2026-07-30

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service.

Details

Root Cause
  1. montage -geometry ":" ... reaches MagickCore/geometry.c:GetGeometry().
  2. StringToDouble/InterpretLocaleValue parses ":" as 0.0; then: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355 WidthValue (and/or HeightValue) is set with a zero dimension.
  3. In MagickCore/resize.c:ThumbnailImage(), the code computes: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629 causing a division by zero and immediate crash.
The issue is trivially triggerable without external input files (e.g., using xc:white).

Reproduction

Environment
Version: ImageMagick 7.1.2-1 (Beta) Q16-HDRI x86 64 0ba1b587b:20250812 https://imagemagick.org
Features: Cipher DPC HDRI
Delegates (built-in): bzlib fontconfig freetype jbig jng jpeg lcms lzma pangocairo png tiff x xml zlib
Compiler: clang (14.0.0)
OS/Arch: Linux x86 64
Steps
./bin/magick montage -geometry : xc:white null:
Observed result
IOT instruction (core dumped)
# (Environment-dependent: SIGFPE/abort may be observed.)

PoC

No external file required; the pseudo image xc:white suffices:
./bin/magick montage -geometry : xc:white null:

Impact

  • Denial of Service: A divide-by-zero in ThumbnailImage() causes immediate abnormal termination (e.g., SIGFPE/abort), crashing the ImageMagick process.

Suggested fix

Defensively reject zero dimensions early in ThumbnailImage():
c
if ((columns == 0) || (rows == 0)) {
 (void) ThrowMagickException(exception, GetMagickModule(), OptionError,
  "InvalidGeometry", "thumbnail requires non-zero dimensions: %.20gx%.20g",
  (double) columns, (double) rows);
 return (Image *) NULL;
}
Additionally, consider tightening validation in GetGeometry() so that colon-only (and similar malformed) inputs do not yield WidthValue/HeightValue with zero, or are rejected outright. Variants like "x:" or ":x" may also need explicit handling (maintainer confirmation requested).

Credits

Team Daemon Fuzz Hunters

Bug Hunting Master Program, HSpace/Findthegap
Woojin Park @jin-156 1203kids@gmail.com
Hojun Lee @leehohojune leehojune@korea.ac.kr
Youngin Won @amethyst0225 youngin04@korea.ac.kr
Siyeon Han @hanbunny kokosyeon@gmail.com

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

JLSEC-2026-923

Affected Products

Imagemagick Jll