PT-2026-76339 · Julia · Imagemagick Jll

Published

2026-07-30

·

Updated

2026-07-30

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in Denial of Service.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3704942==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x7f9d141239e0 bp 0x7ffd4c5711e0 sp 0x7ffd4c571148 T0)
  #0 0x7f9d141239e0 (/lib/x86 64-linux-gnu/libc.so.6+0xc49e0)
  #1 0x558a25e4f08d in ClonePixelCacheRepository. omp fn.0 MagickCore/cache.c:784
  #2 0x7f9d14c06a15 in GOMP parallel (/lib/x86 64-linux-gnu/libgomp.so.1+0x14a15)
  #3 0x558a25e43151 in ClonePixelCacheRepository MagickCore/cache.c:753
  #4 0x558a25e49a96 in OpenPixelCache MagickCore/cache.c:3849
  #5 0x558a25e45117 in GetImagePixelCache MagickCore/cache.c:1829
  #6 0x558a25e4dde3 in SyncImagePixelCache MagickCore/cache.c:5647
  #7 0x558a256ba57d in SetImageExtent MagickCore/image.c:2713

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

JLSEC-2026-948

Affected Products

Imagemagick Jll