A critical memory corruption vulnerability in ImageMagick allows unauthenticated remote attackers to trigger a denial of service through specially crafted image files.

The vulnerability is an uninitialized pointer dereference within the JBIG decoder, triggered by a missing check during image processing. An unauthenticated attacker can exploit this by providing a malformed image file to the affected software, leading to a crash of the service.

Successful exploitation results in a denial of service, which can cause significant operational disruption for applications relying on ImageMagick for image processing tasks. While the CVSS score of 7.5 reflects a high severity primarily due to availability impact, the risk is amplified in environments where image processing is a core business function. Unauthorized access or data compromise is not indicated, but the potential for widespread service instability presents a clear operational risk.

Immediate Action: Update ImageMagick to version 7.1.2-16 or 6.9.13-41 immediately. If using the Magick.NET NuGet packages, update to version 14.10.4 to incorporate the necessary patches.

Proactive Monitoring: Monitor server logs and application error reporting for frequent segmentation faults or abnormal process terminations related to the ImageMagick library.

Compensating Controls: Implement input validation to restrict image processing to trusted sources and enforce file size or type limitations to reduce the attack surface for malformed JBIG payloads.

Public Exploit Available: Unknown.

Organizations should prioritize the update of ImageMagick installations to the specified patched versions to prevent potential denial of service attacks. Because image processing components are frequently exposed to external user input, the risk of exploitation is elevated for web-facing applications. Immediate patching is the recommended course of action to ensure system stability and availability.