CVE-2019-17541

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c...

8.8 HighFix available

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.40%Up 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: CVE-2019-17541
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: CVE-2019-17541
Updated: 2026-11-02

EUVDEUVD-2019-7891 No score

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: EUVD-2019-7891
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p8cw-ccq5-gwg9 No score

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c...

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: GHSA-p8cw-ccq5-gwg9
Weakness: CWE-416
Updated: 2026-11-02

OSVALPINE-CVE-2019-17541 8.8

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: ALPINE-CVE-2019-17541
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: CVE-2019-17541
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVJLSEC-2026-832 8.8

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c.

Record: JLSEC-2026-832
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

OSVRHSA-2020:1180 8.8

Red Hat Security Advisory: ImageMagick security, bug fix, and enhancement update

Record: RHSA-2020:1180
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

imagemagick

Affected packages

Affected packages
Package	Affected	Fixed
`imagemagick` Alpine:v3.11	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.12	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.13	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.14	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.15	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.16	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.17	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.18	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.19	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.20	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0

Show 89 moreShow less

Affected packages
Package	Affected	Fixed
`imagemagick` Alpine:v3.21	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.22	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.23	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`imagemagick` Alpine:v3.24	7.0.0-0 up to 7.0.8.56-r0	7.0.8.56-r0
`ImageMagick_jll` Julia	before 6.9.12+0	6.9.12+0
`ImageMagick` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-c++` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`emacs` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-common` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-filesystem` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-nox` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`ImageMagick-c++-devel` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-devel` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-doc` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-perl` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`autotrace` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-devel` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`emacs-el` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-terminal` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape-docs` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-view` Red Hat:enterprise_linux:7::client From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`emacs` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-filesystem` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`ImageMagick` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-c++` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-c++-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-doc` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-perl` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`autotrace` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`emacs-common` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-el` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-nox` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-terminal` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-docs` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-view` Red Hat:enterprise_linux:7::computenode From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`ImageMagick` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-c++` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-perl` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`emacs` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-common` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-filesystem` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-nox` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`ImageMagick-c++-devel` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-devel` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-doc` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`autotrace` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-devel` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`emacs-el` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-terminal` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape-docs` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-view` Red Hat:enterprise_linux:7::server From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`ImageMagick` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-c++` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-perl` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`emacs` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-common` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-filesystem` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-nox` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`ImageMagick-c++-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`ImageMagick-doc` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:6.9.10.68-3.el7	0:6.9.10.68-3.el7
`autotrace` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`autotrace-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.31.1-38.el7	0:0.31.1-38.el7
`emacs-el` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`emacs-terminal` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 1:24.3-23.el7	1:24.3-23.el7
`inkscape-docs` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7
`inkscape-view` Red Hat:enterprise_linux:7::workstation From an advisory covering 82 CVEs	before 0:0.92.2-3.el7	0:0.92.2-3.el7

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17541 is a high vulnerability (CVSS 8.8) in Imagemagick, published October 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in imagemagick 7.0.8.56-r0.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 143 references. The JSON record has them.