ImageMagick discloses divide-by-zero flaw in FLIF encoder (EUVD-2026-82908)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ImageMagick
- Product
- ImageMagick
- First seen
Summary
Per the EUVD listing, ImageMagick versions before 7.1.2-31 and 6.9.13-56 have a division-by-zero flaw in the FLIF encoder that can crash the encoder. The listing assigns a CVSS v3.1 score of 6.3.
If you use ImageMagick
Upgrade to ImageMagick 7.1.2-31 or 6.9.13-56 or later
Avoid encoding FLIF images from untrusted sources until patched
Upgrade ImageMagick to 7.1.2-30 or 6.9.13-55 or later
Limit memory for processes that handle untrusted images
Reject or sandbox MSL files from untrusted sources
Upgrade ImageMagick to 7.1.2-30 or later on Windows
What the sources say 9
· Mastodon: “ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder.” Source
· Mastodon: “ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the upstream advisory, CUBE and HALD) coder: when a specific command line option is supplied, the decoder does not che” Source
· Mastodon: “ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly.” Source
· Mastodon: “ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick.” Source
· Mastodon: “ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps.” Source
· Mastodon: “ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick.” Source
· Mastodon: “ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions” Source
· Mastodon: “ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder.” Source
· Mastodon: “ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails.” Source