CVE-2023-39978
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption)...
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
CVE-2023-39978- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
CVE List No score
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
CVE-2023-39978- Updated
- 2026-11-02
EUVDEUVD-2023-43671 No score
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
EUVD-2023-43671- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j6x7-7g72-8ww2
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption)...
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
GHSA-j6x7-7g72-8ww2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVJLSEC-2026-911
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
JLSEC-2026-911- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2023-1516
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of format (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.(CVE-2023-39978)
- Record
OESA-2023-1516- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1517
ImageMagick security update
Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of format (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.
Security Fix(es):
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.(CVE-2023-39978)
- Record
OESA-2023-1517- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-39978
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
UBUNTU-CVE-2023-39978- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV No score
ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
- Record
CVE-2023-39978- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ImageMagick_jllJulia |
before 6.9.13025+0 | 6.9.13025+0 |
ImageMagickopenEuler:20.03-LTS-SP1 |
before 6.9.12.86-4.oe1 | 6.9.12.86-4.oe1 |
ImageMagickopenEuler:20.03-LTS-SP3 |
before 6.9.12.86-4.oe1 | 6.9.12.86-4.oe1 |
imagemagickUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8:6.9.10.23+dfsg-2.1ubuntu38:6.9.10.23+dfsg-2.1ubuntu88:6.9.10.23+dfsg-2.1ubuntu98:6.9.10.23+dfsg-2.1ubuntu108:6.9.10.23+dfsg-2.1ubuntu11 Show 31 moreShow less8:6.9.10.23+dfsg-2.1ubuntu11.18:6.9.10.23+dfsg-2.1ubuntu11.28:6.9.10.23+dfsg-2.1ubuntu11.48:6.9.10.23+dfsg-2.1ubuntu11.4+esm18:6.9.10.23+dfsg-2.1ubuntu11.58:6.9.10.23+dfsg-2.1ubuntu11.68:6.9.10.23+dfsg-2.1ubuntu11.6+esm18:6.9.10.23+dfsg-2.1ubuntu11.78:6.9.10.23+dfsg-2.1ubuntu11.7+esm18:6.9.10.23+dfsg-2.1ubuntu11.98:6.9.10.23+dfsg-2.1ubuntu11.9+esm18:6.9.10.23+dfsg-2.1ubuntu11.9+esm28:6.9.10.23+dfsg-2.1ubuntu11.108:6.9.10.23+dfsg-2.1ubuntu11.10+esm18:6.9.10.23+dfsg-2.1ubuntu11.118:6.9.10.23+dfsg-2.1ubuntu11.11+esm18:6.9.10.23+dfsg-2.1ubuntu11.11+esm28:6.9.10.23+dfsg-2.1ubuntu11.11+esm38:6.9.10.23+dfsg-2.1ubuntu11.11+esm48:6.9.10.23+dfsg-2.1ubuntu11.11+esm58:6.9.10.23+dfsg-2.1ubuntu11.11+esm68:6.9.10.23+dfsg-2.1ubuntu11.11+esm78:6.9.10.23+dfsg-2.1ubuntu11.11+esm88:6.9.10.23+dfsg-2.1ubuntu11.11+esm98:6.9.10.23+dfsg-2.1ubuntu11.11+esm108:6.9.10.23+dfsg-2.1ubuntu11.11+esm118:6.9.10.23+dfsg-2.1ubuntu11.11+esm128:6.9.10.23+dfsg-2.1ubuntu11.11+esm138:6.9.10.23+dfsg-2.1ubuntu11.11+esm148:6.9.10.23+dfsg-2.1ubuntu11.11+esm158:6.9.10.23+dfsg-2.1ubuntu11.11+esm16 |
None known |
imagemagickUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8:6.9.11.60+dfsg-1ubuntu18:6.9.11.60+dfsg-1.38:6.9.11.60+dfsg-1.3build18:6.9.11.60+dfsg-1.3build28:6.9.11.60+dfsg-1.3ubuntu0.22.04.1 Show 24 moreShow less8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.28:6.9.11.60+dfsg-1.3ubuntu0.22.04.2+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.38:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm18:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm28:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm38:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm48:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm58:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm68:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm78:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm88:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm98:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm108:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm118:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm128:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm138:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm148:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm158:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm16 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-39978 is a low vulnerability (CVSS 3.3) in Imagemagick, published August 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in ImageMagick_jll 6.9.13025+0.
References
github.com/rmagick/rmagick/pull/1406/files
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UFQJCYJ23HWHNDOVKBHZQ7HCXXL6MM3
nvd.nist.gov/vuln/detail/CVE-2023-39978
Show 6 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1516
ubuntu.com/security/CVE-2023-39978
cve.org/CVERecord?id=CVE-2023-39978