Description

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T17:17:17.577Z",
  "pubdate": "2026-10-12T17:17:17.577Z",
  "executiveSummary": "ImageMagick versions prior to 6.9.13-57 and 7.1.2-32 are susceptible to an uninitialized memory read vulnerability within the TGA image decoder component.\nThis flaw permits an attacker to facilitate information disclosure by processing a specially crafted TGA file, resulting in the leakage of sensitive data residing in the process memory space.\nThe vulnerability type is classified as an uninitialized memory read, which can potentially expose internal memory structures, stack contents, or heap data to unauthorized actors.\nExploitation does not inherently require high privileges but necessitates that the target system processes a malicious TGA image provided by the attacker.\nThe primary risk implication is the compromise of confidentiality, as leaked memory could contain sensitive information such as cryptographic keys, credentials, or other proprietary process data.\nThis issue affects the ImageMagick suite across multiple platforms and implementations that utilize the vulnerable TGA decoding logic.",
  "technicalDetails": "The vulnerability exists within the ImageMagick TGA (Truevision Graphics Adapter) image format decoder. The root cause is a failure to properly initialize memory buffers before they are read during the decoding process.\nIn the context of the TGA decoder, specific fields or pixel data structures are allocated but not zero-initialized before being accessed by the decoder logic. When a malformed or crafted TGA file is processed, the decoder may attempt to read these uninitialized memory regions as part of the image rendering or processing pipeline.\nAttack flow typically begins when a user or automated system initiates a process (such as a thumbnail generation or image format conversion) on a malicious TGA file. As ImageMagick parses the TGA header and subsequent image data, the flawed decoder logic consumes the uninitialized heap or stack memory.\nBecause the memory contents are uninitialized, the values read by the decoder are essentially 'garbage' data left over from previous operations within the process memory space. If the attacker can influence the state of the process memory—or if the leaked data includes sensitive pointers, pointers to objects, or raw data—they can extract this information via the resulting output image.\nThe affected versions are explicitly identified as ImageMagick before 6.9.13-57 (6.x branch) and 7.x before 7.1.2-32. The vulnerability does not require authentication or specific elevated privileges, provided the attacker can supply the input file to the vulnerable component.\nFrom a post-exploitation perspective, the impact is primarily information disclosure. By repeatedly sending crafted payloads and analyzing the differences in the resulting processed images, an attacker may conduct memory scraping, potentially leading to the reconstruction of sensitive data stored within the ImageMagick process memory. This represents a classic side-channel leakage through application data output.\nThe vulnerability is restricted to the TGA handling logic; however, because ImageMagick is widely integrated into web applications, content management systems, and backend image processing pipelines, the exposure surface is significant."
}