ImageMagick: Information Disclosure when printing profiles with debug enabled

LOW 2.9CVE-2026-61862 · GHSA-hwf3-r46v-5ggx · Published 15/07/2026 · updated 29/10/2026

Package	Affected versions	Patched versions
Magick.NET-Q16-AnyCPU NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-HDRI-AnyCPU NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-HDRI-OpenMP-arm64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-HDRI-arm64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-HDRI-x64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-HDRI-x86 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-OpenMP-arm64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-OpenMP-x64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-arm64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-x64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q16-x86 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q8-AnyCPU NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q8-OpenMP-arm64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q8-OpenMP-x64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q8-arm64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q8-x64 NuGet	`< 14.15.0`	`14.15.0`
Magick.NET-Q8-x86 NuGet	`< 14.15.0`	`14.15.0`

Description

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

NVD description

ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed (read past the profile boundary). This behavior occurs when debug output is enabled.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free