GHSA-gq5v-qf8q-fp77: ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization

February 25, 2026

OpenPixelCache updates image channel metadata before attempting pixel cache memory allocation. When both memory and disk allocation fail a heap-buffer-overflow read in occurs in any writer that calls GetPixelIndex.

References

github.com/ImageMagick/ImageMagick
github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77
github.com/advisories/GHSA-gq5v-qf8q-fp77
github.com/dlemstra/Magick.NET/releases/tag/14.10.3

Code Behaviors & Features

Detect and mitigate GHSA-gq5v-qf8q-fp77 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →