{"id":"CVE-2022-1114","aliases":["ALPINE-CVE-2022-1114","DEBIAN-CVE-2022-1114","EUVD-2022-24457","GHSA-rhcm-mpjw-m6hf","JLSEC-2026-893","MGASA-2022-0446","OESA-2022-1670","UBUNTU-CVE-2022-1114","USN-5736-1","USN-5736-2","openSUSE-SU-2024:13263-1"],"status":"published","title":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file....","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0117,"percentile":0.67668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-04-29T15:38:57Z","modified":"2026-11-03T08:01:48Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"imagemagick","fixed_in":["7.1.0.30-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.5"],"sources":["osv"]},{"ecosystem":"Julia","package":"ImageMagick_jll","fixed_in":["6.9.12+3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ImageMagick","fixed_in":["6.9.12.43-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"ImageMagick","fixed_in":["6.9.12.43-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"ImageMagick","fixed_in":["7.1.0.28-1.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","fixed_in":["8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"7.1.0.30-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.5"}]}]},{"source":"osv","ecosystem":"Julia","package":"ImageMagick_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.9.12+3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.52-1.1.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"abydos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"converseen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8.1-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"digikam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-4.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"libopenshot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.5-5.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"php-imagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-0.git20201230.2.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"synfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-11.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"windowmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.95.9-3.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"xine-lib1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"zbar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-5.2.mga8"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.52-1.1.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"abydos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"transcode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-29.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:8","package":"xine-lib1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1.2.mga8.tainted"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.12.43-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.12.43-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0.28-1.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.7.7.10-6ubuntu3.13+esm3"}]}],"versions":["8:6.7.7.10-5ubuntu3","8:6.7.7.10-5ubuntu4","8:6.7.7.10-6ubuntu1","8:6.7.7.10-6ubuntu2","8:6.7.7.10-6ubuntu3","8:6.7.7.10-6ubuntu3.1","8:6.7.7.10-6ubuntu3.2","8:6.7.7.10-6ubuntu3.3","8:6.7.7.10-6ubuntu3.4","8:6.7.7.10-6ubuntu3.5","8:6.7.7.10-6ubuntu3.6","8:6.7.7.10-6ubuntu3.7","8:6.7.7.10-6ubuntu3.8","8:6.7.7.10-6ubuntu3.9","8:6.7.7.10-6ubuntu3.11","8:6.7.7.10-6ubuntu3.12","8:6.7.7.10-6ubuntu3.13","8:6.7.7.10-6ubuntu3.13+esm1","8:6.7.7.10-6ubuntu3.13+esm2"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.8.9.9-7ubuntu5.16+esm5"}]}],"versions":["8:6.8.9.9-5ubuntu2","8:6.8.9.9-6","8:6.8.9.9-6build1","8:6.8.9.9-7","8:6.8.9.9-7ubuntu1","8:6.8.9.9-7ubuntu2","8:6.8.9.9-7ubuntu3","8:6.8.9.9-7ubuntu4","8:6.8.9.9-7ubuntu5","8:6.8.9.9-7ubuntu5.1","8:6.8.9.9-7ubuntu5.2","8:6.8.9.9-7ubuntu5.3","8:6.8.9.9-7ubuntu5.4","8:6.8.9.9-7ubuntu5.5","8:6.8.9.9-7ubuntu5.6","8:6.8.9.9-7ubuntu5.7","8:6.8.9.9-7ubuntu5.8","8:6.8.9.9-7ubuntu5.9","8:6.8.9.9-7ubuntu5.11","8:6.8.9.9-7ubuntu5.12","8:6.8.9.9-7ubuntu5.13","8:6.8.9.9-7ubuntu5.14","8:6.8.9.9-7ubuntu5.15","8:6.8.9.9-7ubuntu5.16","8:6.8.9.9-7ubuntu5.16+esm1","8:6.8.9.9-7ubuntu5.16+esm2","8:6.8.9.9-7ubuntu5.16+esm3","8:6.8.9.9-7ubuntu5.16+esm4"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.7.4+dfsg-16ubuntu6.14"}]}],"versions":["8:6.9.7.4+dfsg-16ubuntu2","8:6.9.7.4+dfsg-16ubuntu3","8:6.9.7.4+dfsg-16ubuntu4","8:6.9.7.4+dfsg-16ubuntu5","8:6.9.7.4+dfsg-16ubuntu6","8:6.9.7.4+dfsg-16ubuntu6.2","8:6.9.7.4+dfsg-16ubuntu6.3","8:6.9.7.4+dfsg-16ubuntu6.4","8:6.9.7.4+dfsg-16ubuntu6.7","8:6.9.7.4+dfsg-16ubuntu6.8","8:6.9.7.4+dfsg-16ubuntu6.9","8:6.9.7.4+dfsg-16ubuntu6.11","8:6.9.7.4+dfsg-16ubuntu6.12","8:6.9.7.4+dfsg-16ubuntu6.13"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.10.23+dfsg-2.1ubuntu11.4+esm1"}]}],"versions":["8:6.9.10.23+dfsg-2.1ubuntu3","8:6.9.10.23+dfsg-2.1ubuntu8","8:6.9.10.23+dfsg-2.1ubuntu9","8:6.9.10.23+dfsg-2.1ubuntu10","8:6.9.10.23+dfsg-2.1ubuntu11","8:6.9.10.23+dfsg-2.1ubuntu11.1","8:6.9.10.23+dfsg-2.1ubuntu11.2","8:6.9.10.23+dfsg-2.1ubuntu11.4"],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"imagemagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1"}]}],"versions":["8:6.9.11.60+dfsg-1ubuntu1","8:6.9.11.60+dfsg-1.3","8:6.9.11.60+dfsg-1.3build1","8:6.9.11.60+dfsg-1.3build2","8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1"],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ImageMagick","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1.17-1.1"}]}],"bundled":15}],"products":[{"vendor":"imagemagick","product":"imagemagick"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064538","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1114","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rhcm-mpjw-m6hf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-1114","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1114.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1114","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0446.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29054","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QPPJFFJWUIW3K6NB472QVFG522DWQZET/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5158-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZUE6OO6UE5NEQ2LYEJSEB2AXREVWZVMB/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3007","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4SLHXE2O3IXMI4KAK7QSBITGXIK6OW2/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-May/011200.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5456-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FYRR2QY5S3HG4B4EAPF6BVV54BZQPUX5/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5534-1","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-September/012065.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DQYFWVB5WL5D7BG6DWWI7RKZDHYKRQR6/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LNVDNM4ZEIYPT3SLZHPYN7OG4CZLEXZJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/T6VPXZJUL64MXAMQ4JA6V6TYNOXDC6SQ/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/65CCSW6TK2CGQU6OYUEHQBBH6OSPKUJP/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5736-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1670","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1114","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5736-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-4219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-39212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32545","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32547","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-34153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-1114","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T15:38:57Z","modified":"2024-08-02T23:55:23.392Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2022-24457","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T15:38:57Z","modified":"2024-08-02T23:55:23Z","updated_at":"2026-11-03T03:26:02.561344Z"}],"ghsa":[{"id":"GHSA-rhcm-mpjw-m6hf","title":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file....","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-30T00:00:36Z","modified":"2023-01-30T05:04:22Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:47:01.801326Z"}],"nvd":[{"id":"CVE-2022-1114","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T16:15:08.587Z","modified":"2026-06-17T04:21:51.163Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"ALPINE-CVE-2022-1114","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T16:15:08.587Z","modified":"2026-11-03T07:31:03.314499157Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"DEBIAN-CVE-2022-1114","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T16:15:08.587Z","modified":"2026-11-03T08:01:48.254150491Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"JLSEC-2026-893","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2026-07-30T16:02:27.435Z","modified":"2026-07-30T18:23:50.104434864Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2022-1670","title":"ImageMagick security update","description":"Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats (over 200) including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images, adjust image colors, apply various special effects, or draw text, lines, polygons, ellipses and Bézier curves.\n\nSecurity Fix(es):\n\nA heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.(CVE-2022-1114)","status":"published","published":"2022-05-25T11:04:56Z","modified":"2026-08-18T01:16:35.127182049Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-1114","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T16:15:00Z","modified":"2026-04-22T13:12:46.425453Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CVE-2022-1114","description":"A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.","status":"published","published":"2022-04-29T15:38:57Z","modified":"2026-10-28T02:30:34.354204432Z","cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"MGASA-2022-0446","title":"Updated imagemagick packages fix security vulnerability","description":"A vulnerability was found in ImageMagick-7.0.11-5, where executing a\ncrafted file with the convert command, ASAN detects memory leaks.\n(CVE-2021-3574)\n\nA flaw was found in ImageMagick. The vulnerability occurs due to improper\nuse of open functions and leads to a denial of service. This flaw allows\nan attacker to crash the system. (CVE-2021-4219)\n\nAn integer overflow issue was discovered in ImageMagick's\nExportIndexQuantum() function in MagickCore/quantum-export.c. Function\ncalls to GetPixelIndex() could result in values outside the range of\nrepresentable for the 'unsigned char'. When ImageMagick processes a\ncrafted pdf file, this could lead to an undefined behaviour or a crash.\n(CVE-2021-20224)\n\nA flaw was found in ImageMagick in versions before 7.0.11 and before\n6.9.12, where a division by zero in WaveImage() of\nMagickCore/visual-effects.c may trigger undefined behavior via a crafted\nimage file submitted to an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20309)\n\nA flaw was found in ImageMagick in versions before 7.0.11, where a\ndivision by zero in sRGBTransformImage() in the MagickCore/colorspace.c\nmay trigger undefined behavior via a crafted image file that is submitted\nby an attacker processed by an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20311)\n\nA flaw was found in ImageMagick in versions 7.0.11, where an integer\noverflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger\nundefined behavior via a crafted image file that is submitted by an\nattacker and processed by an application using ImageMagick. The highest\nthreat from this vulnerability is to system availability. (CVE-2021-20312)\n\nA flaw was found in ImageMagick in versions before 7.0.11. A potential\ncipher leak when the calculate signatures in TransformSignature is\npossible. The highest threat from this vulnerability is to data\nconfidentiality. (CVE-2021-20313)\n\nA heap-based-buffer-over-read flaw was found in ImageMagick's\nGetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is\ntriggered when an attacker passes a specially crafted Tagged Image File\nFormat (TIFF) image to convert it into a PICON file format. This issue can\npotentially lead to a denial of service and information disclosure.\n(CVE-2022-0284)\n\nA heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo()\nfunction of dcm.c file. This vulnerability is triggered when an attacker\npasses a specially crafted DICOM image file to ImageMagick for conversion,\npotentially leading to information disclosure and a denial of service.\n(CVE-2022-1114)\n\nIn GraphicsMagick, a heap buffer overflow was found when parsing MIFF.\n(CVE-2022-1270)\n\nIn ImageMagick, a crafted file could trigger an assertion failure when a\ncall to WriteImages was made in MagickWand/operation.c, due to a NULL\nimage list. This could potentially cause a denial of service. This was\nfixed in upstream ImageMagick version 7.1.0-30. (CVE-2022-2719)\n\nA heap buffer overflow issue was found in ImageMagick. When an application\nprocesses a malformed TIFF file, it could lead to undefined behavior or a\ncrash causing a denial of service. (CVE-2022-3213)\n\nImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. (CVE-2022-28463)\n\nA vulnerability was found in ImageMagick, causing an outside the range of\nrepresentable values of type 'unsigned char' at coders/psd.c, when crafted\nor untrusted input is processed. This leads to a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32545)\n\nA vulnerability was found in ImageMagick, causing an outside the range of\nrepresentable values of type 'unsigned long' at coders/pcl.c, when crafted\nor untrusted input is processed. This leads to a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32546)\n\nIn ImageMagick, there is load of misaligned address for type 'double',\nwhich requires 8 byte alignment and for type 'float', which requires 4\nbyte alignment at MagickCore/property.c. Whenever crafted or untrusted\ninput is processed by ImageMagick, this causes a negative impact to\napplication availability or other problems related to undefined behavior.\n(CVE-2022-32547)\n","status":"published","published":"2022-12-06T23:32:48Z","modified":"2026-04-16T04:42:52.784365911Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13263-1","title":"ImageMagick-7.1.1.17-1.1 on GA media","description":"These are all security issues fixed in the ImageMagick-7.1.1.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:15.510489Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"USN-5736-1","title":"imagemagick vulnerabilities","description":"It was discovered that ImageMagick incorrectly handled certain values\nwhen processing PDF files. If a user or automated system using ImageMagick\nwere tricked into opening a specially crafted PDF file, an attacker could\nexploit this to cause a denial of service. This issue only affected Ubuntu\n14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-20224)\n\nZhang Xiaohui discovered that ImageMagick incorrectly handled certain\nvalues when processing image data. If a user or automated system using\nImageMagick were tricked into opening a specially crafted image, an\nattacker could exploit this to cause a denial of service. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2021-20241)\n\nZhang Xiaohui discovered that ImageMagick incorrectly handled certain\nvalues when processing image data. If a user or automated system using\nImageMagick were tricked into opening a specially crafted image, an\nattacker could exploit this to cause a denial of service. This issue only\naffected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 22.10.\n(CVE-2021-20243)\n\nIt was discovered that ImageMagick incorrectly handled certain values\nwhen processing visual effects based image files. By tricking a user into\nopening a specially crafted image file, an attacker could crash the\napplication causing a denial of service. This issue only affected Ubuntu\n22.10. (CVE-2021-20244)\n\nIt was discovered that ImageMagick could be made to divide by zero when\nprocessing crafted files. By tricking a user into opening a specially\ncrafted image file, an attacker could crash the application causing a\ndenial of service. This issue only affected Ubuntu 22.10. (CVE-2021-20245)\n\nIt was discovered that ImageMagick incorrectly handled certain values\nwhen performing resampling operations. By tricking a user into opening\na specially crafted image file, an attacker could crash the application\ncausing a denial of service. This issue only affected Ubuntu 22.10.\n(CVE-2021-20246)\n\nIt was discovered that ImageMagick incorrectly handled certain values\nwhen processing visual effects based image files. By tricking a user into\nopening a specially crafted image file, an attacker could crash the\napplication causing a denial of service. This issue only affected Ubuntu\n22.10. (CVE-2021-20309)\n\nIt was discovered that ImageMagick incorrectly handled certain values\nwhen processing thumbnail image data. By tricking a user into opening\na specially crafted image file, an attacker could crash the application\ncausing a denial of service. This issue only affected Ubuntu 22.10.\n(CVE-2021-20312)\n\nIt was discovered that ImageMagick incorrectly handled memory cleanup\nwhen performing certain cryptographic operations. Under certain conditions\nsensitive cryptographic information could be disclosed. This issue only\naffected Ubuntu 22.10. (CVE-2021-20313)\n\nIt was discovered that ImageMagick did not properly manage memory under\ncertain circumstances. If a user were tricked into opening a specially\ncrafted file using the convert command, an attacker could possibly use\nthis issue to cause ImageMagick to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 22.10. (CVE-2021-3574)\n\nIt was discovered that ImageMagick did not use the correct rights when\nspecifically excluded by a module policy. An attacker could use this issue\nto read and write certain restricted files. This issue only affected\nUbuntu 22.10. (CVE-2021-39212)\n\nIt was discovered that ImageMagick incorrectly handled certain values\nwhen processing specially crafted SVG files. By tricking a user into\nopening a specially crafted SVG file, an attacker could crash the\napplication causing a denial of service. This issue only affected Ubuntu\n22.10. (CVE-2021-4219)\n\nIt was discovered that ImageMagick did not properly manage memory under\ncertain circumstances. If a user were tricked into opening a specially\ncrafted DICOM file, an attacker could possibly use this issue to cause\nImageMagick to crash, resulting in a denial of servicei, or expose sensitive\ninformation. This issue only affected Ubuntu 22.10. (CVE-2022-1114)\n\nIt was discovered that ImageMagick incorrectly handled memory under\ncertain circumstances. If a user were tricked into opening a specially\ncrafted image file, an attacker could possibly exploit this issue to cause\na denial of service or other unspecified impact. This issue only affected\nUbuntu 22.10. (CVE-2022-28463)\n\nIt was discovered that ImageMagick incorrectly handled certain values.\nIf a user were tricked into processing a specially crafted image file,\nan attacker could possibly exploit this issue to cause a denial of service\nor other unspecified impact. This issue only affected Ubuntu 14.04 ESM,\nUbuntu 18.04 LTS and Ubuntu 22.10. (CVE-2022-32545, CVE-2022-32546)\n\nIt was discovered that ImageMagick incorrectly handled memory under\ncertain circumstances. If a user were tricked into processing a specially\ncrafted image file, an attacker could possibly exploit this issue to cause\na denial of service or other unspecified impact. This issue only affected\nUbuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2022-32547)\n","status":"published","published":"2022-11-24T08:11:00Z","modified":"2026-06-29T13:50:42.814597449Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5736-2","title":"imagemagick vulnerabilities","description":"USN-5736-1 fixed vulnerabilities in ImageMagick. This update provides the\ncorresponding updates for Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. One of the\nissues, CVE-2021-20224, only affected Ubuntu 20.04 ESM, while\nCVE-2021-20245, CVE-2021-3574, CVE-2021-4219 and CVE-2022-1114 only\naffected Ubuntu 22.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that ImageMagick incorrectly handled certain values\n when processing PDF files. If a user or automated system using ImageMagick\n were tricked into opening a specially crafted PDF file, an attacker could\n exploit this to cause a denial of service. This issue only affected Ubuntu\n 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-20224)\n \n Zhang Xiaohui discovered that ImageMagick incorrectly handled certain\n values when processing image data. If a user or automated system using\n ImageMagick were tricked into opening a specially crafted image, an\n attacker could exploit this to cause a denial of service. This issue only\n affected Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2021-20241)\n \n Zhang Xiaohui discovered that ImageMagick incorrectly handled certain\n values when processing image data. If a user or automated system using\n ImageMagick were tricked into opening a specially crafted image, an\n attacker could exploit this to cause a denial of service. This issue only\n affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 22.10.\n (CVE-2021-20243)\n \n It was discovered that ImageMagick incorrectly handled certain values\n when processing visual effects based image files. By tricking a user into\n opening a specially crafted image file, an attacker could crash the\n application causing a denial of service. This issue only affected Ubuntu\n 22.10. (CVE-2021-20244)\n \n It was discovered that ImageMagick could be made to divide by zero when\n processing crafted files. By tricking a user into opening a specially\n crafted image file, an attacker could crash the application causing a\n denial of service. This issue only affected Ubuntu 22.10. (CVE-2021-20245)\n \n It was discovered that ImageMagick incorrectly handled certain values\n when performing resampling operations. By tricking a user into opening\n a specially crafted image file, an attacker could crash the application\n causing a denial of service. This issue only affected Ubuntu 22.10.\n (CVE-2021-20246)\n \n It was discovered that ImageMagick incorrectly handled certain values\n when processing visual effects based image files. By tricking a user into\n opening a specially crafted image file, an attacker could crash the\n application causing a denial of service. This issue only affected Ubuntu\n 22.10. (CVE-2021-20309)\n \n It was discovered that ImageMagick incorrectly handled certain values\n when processing thumbnail image data. By tricking a user into opening\n a specially crafted image file, an attacker could crash the application\n causing a denial of service. This issue only affected Ubuntu 22.10.\n (CVE-2021-20312)\n \n It was discovered that ImageMagick incorrectly handled memory cleanup\n when performing certain cryptographic operations. Under certain conditions\n sensitive cryptographic information could be disclosed. This issue only\n affected Ubuntu 22.10. (CVE-2021-20313)\n \n It was discovered that ImageMagick did not properly manage memory under\n certain circumstances. If a user were tricked into opening a specially\n crafted file using the convert command, an attacker could possibly use\n this issue to cause ImageMagick to crash, resulting in a denial of\n service. This issue only affected Ubuntu 22.10. (CVE-2021-3574)\n \n It was discovered that ImageMagick did not use the correct rights when\n specifically excluded by a module policy. An attacker could use this issue\n to read and write certain restricted files. This issue only affected\n Ubuntu 22.10. (CVE-2021-39212)\n \n It was discovered that ImageMagick incorrectly handled certain values\n when processing specially crafted SVG files. By tricking a user into\n opening a specially crafted SVG file, an attacker could crash the\n application causing a denial of service. This issue only affected Ubuntu\n 22.10. (CVE-2021-4219)\n \n It was discovered that ImageMagick did not properly manage memory under\n certain circumstances. If a user were tricked into opening a specially\n crafted DICOM file, an attacker could possibly use this issue to cause\n ImageMagick to crash, resulting in a denial of service, or expose sensitive\n information. This issue only affected Ubuntu 22.10. (CVE-2022-1114)\n \n It was discovered that ImageMagick incorrectly handled memory under\n certain circumstances. If a user were tricked into opening a specially\n crafted image file, an attacker could possibly exploit this issue to cause\n a denial of service or other unspecified impact. This issue only affected\n Ubuntu 22.10. (CVE-2022-28463)\n \n It was discovered that ImageMagick incorrectly handled certain values.\n If a user were tricked into processing a specially crafted image file,\n an attacker could possibly exploit this issue to cause a denial of service\n or other unspecified impact. This issue only affected Ubuntu 14.04 ESM,\n Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2022-32545, CVE-2022-32546)\n \n It was discovered that ImageMagick incorrectly handled memory under\n certain circumstances. If a user were tricked into processing a specially\n crafted image file, an attacker could possibly exploit this issue to cause\n a denial of service or other unspecified impact. This issue only affected\n Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 22.10. (CVE-2022-32547)\n","status":"published","published":"2022-11-24T11:23:13Z","modified":"2026-04-27T16:32:23.475548582Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}