CVE-2012-1186

Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and...

5.5 MediumFix available

CVE-2012-1186 is a medium vulnerability (CVSS 5.5) in Imagemagick, published April 29, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in imagemagick 8:6.6.9.7-7.

Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.88%Down 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 5.5

Record: CVE-2012-1186
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-835
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-1186
Updated: 2026-11-02

EUVDEUVD-2012-1215 No score

Record: EUVD-2012-1215
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3xpw-25qv-r984 5.5

Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and...

Record: GHSA-3xpw-25qv-r984
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

OSV 5.5

Record: CVE-2012-1186
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-1186 5.5

Record: DEBIAN-CVE-2012-1186
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10040-1 No score

ImageMagick-6.9.6.6-1.1 on GA media

These are all security issues fixed in the ImageMagick-6.9.6.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10040-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`imagemagick` Debian:12	before 8:6.6.9.7-7	8:6.6.9.7-7
`imagemagick` Debian:13	before 8:6.6.9.7-7	8:6.6.9.7-7
`imagemagick` Debian:14	before 8:6.6.9.7-7	8:6.6.9.7-7
`imagemagick` Debian:6.0	before 8:6.6.0.4-3+squeeze3, plus listed versions 8:6.6.0.4-38:6.6.0.4-3+squeeze18:6.6.0.4-3+squeeze2	8:6.6.0.4-3+squeeze3
`ImageMagick` openSUSE:Tumbleweed	before 6.9.6.6-1.1	6.9.6.6-1.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 20 moreShow less