GHSA-VF33-6R7X-66XX: Division by Zero and Integer Overflow in ImageMagick Morphology

Vulnerability ID: GHSA-VF33-6R7X-66XX
CVSS Score: 3.3
Published: 2026-05-21

ImageMagick versions prior to 7.1.1-33 contain an integer overflow vulnerability within the morphology module's binomial kernel generation logic. This integer overflow propagates to yield a division by zero error, resulting in a denial of service.

TL;DR

An unbounded integer overflow in ImageMagick's factorial calculation for binomial kernels leads to a mathematical division by zero. Attackers can trigger this denial of service by supplying an excessively large kernel radius.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-369, CWE-190
Attack Vector: Local / Context-Dependent API
Impact: Denial of Service (Application Crash)
Exploit Status: Proof-of-Concept
Severity: Low
CISA KEV: Not Listed

Affected Systems

ImageMagick
Magick.NET
ImageMagick: < 7.1.1-33 (Fixed in: 7.1.1-33)
Magick.NET: < 7.1.1-33 equivalent (Fixed in: 7.1.1-33 equivalent)

Code Analysis

Commit: d67eef7

Fix for integer overflow and division by zero in binomial kernel generation

Exploit Details

ImageMagick Issue Tracker: Triggering payload via ImageMagick CLI

Mitigation Strategies

Update ImageMagick and associated wrapper libraries (Magick.NET) to version 7.1.1-33 or newer.
Implement strict input validation for user-supplied image processing parameters, explicitly limiting morphology kernel radius sizes.
Ensure web applications do not directly pass unvalidated user input into ImageMagick command-line arguments.

Remediation Steps:

Identify all deployments of ImageMagick and Magick.NET within the environment.
Upgrade all identified packages to at least version 7.1.1-33.
Audit applications interacting with the ImageMagick API to confirm that morphology operations (specifically Binomial) utilize sanitized parameters.
Restart dependent application pools and services to ensure the patched shared libraries are loaded.