CVE-2022-44267
MediumPublic exploitImageMagick 7.1.0-49 is vulnerable to Denial of Service.
Published Feb 6, 2023 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2022-44267, DSA-5347-1, SUSE-SU-2023:0421-1, SUSE-SU-2023:0424-1, SUSE-SU-2023:0428-1, UBUNTU-CVE-2022-44267, USN-5855-1, USN-5855-2, USN-5855-4
Key Facts
Patch immediately- CVE-2022-44267 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting ImageMagick, rootio-imagemagick, ImageMagick-c++-devel (amazon) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 77% probability of exploitation in the next 30 days.
- Fixed versions are available, including ImageMagick 7.1.0.52-r0, ImageMagick 8:6.7.7.10-6ubuntu3.13+esm5, ImageMagick 8:6.8.9.9-7ubuntu5.16+esm7.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
77%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2022-44267 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
Affected Products
292 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ImageMagickImagemagick | 7.1.0-49 | 7.1.0.52-r0 |
| rootio-imagemagickrootio | See advisory | 8:6.9.11.60+dfsg-1.3+deb11u1 |
| ImageMagick-c++-develamazon | See advisory | 6.9.10.68-3.24.amzn1 |
| ImageMagick-c++amazon | See advisory | 6.9.10.68-3.24.amzn1 |
| ImageMagick-develamazon | See advisory | 6.9.10.68-3.24.amzn1 |
Patched Releases
ImageMagick
7.1.0.52-r0, 8:6.7.7.10-6ubuntu3.13+esm5, 8:6.8.9.9-7ubuntu5.16+esm7, 8:6.9.10.23+dfsg-2.1+deb10u2, 8:6.9.10.23+dfsg-2.1ubuntu11.5, 8:6.9.11.60+dfsg-1.3+deb11u1, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1, 8:6.9.11.60+dfsg-1.6, 8:6.9.7.4+dfsg-16ubuntu6.15, 1:6.9.12.77-1.amzn2023.0.1, 6.8.8.1-71.183.1, 6.9.10.68-3.24.amzn1, 6.9.10.68-6.amzn2.0.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.19-8.ph3, 7.1.0.19-8.ph4, 7.1.0.9-150400.6.12.1, 7.1.1.11-1.ph5, 7.1.1.17-1.1
ImageMagick-c++
1:6.9.12.77-1.amzn2023.0.1, 6.9.10.68-3.24.amzn1, 6.9.10.68-6.amzn2.0.1, 7.1.0.19-8.ph4, 7.1.1.11-1.ph5
ImageMagick-c++-devel
1:6.9.12.77-1.amzn2023.0.1, 6.9.10.68-3.24.amzn1, 6.9.10.68-6.amzn2.0.1, 7.1.0.19-8.ph4, 7.1.1.11-1.ph5
ImageMagick-config-6-SUSE
6.8.8.1-71.183.1
ImageMagick-config-6-upstream
6.8.8.1-71.183.1
ImageMagick-config-7-SUSE
7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
ImageMagick-config-7-upstream
7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1
ImageMagick-config-7-upstream-limited
7.1.1.17-1.1
ImageMagick-config-7-upstream-open
7.1.1.17-1.1
ImageMagick-config-7-upstream-secure
7.1.1.17-1.1
ImageMagick-config-7-upstream-websafe
7.1.1.17-1.1
ImageMagick-devel
1:6.9.12.77-1.amzn2023.0.1, 6.8.8.1-71.183.1, 6.9.10.68-3.24.amzn1, 6.9.10.68-6.amzn2.0.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.19-8.ph4, 7.1.0.9-150400.6.12.1, 7.1.1.11-1.ph5, 7.1.1.17-1.1
ImageMagick-devel-32bit
7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
ImageMagick-doc
1:6.9.12.77-1.amzn2023.0.1, 6.9.10.68-3.24.amzn1, 6.9.10.68-6.amzn2.0.1, 7.1.0.19-8.ph4, 7.1.0.9-150400.6.12.1, 7.1.1.11-1.ph5, 7.1.1.17-1.1
ImageMagick-extra
7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
ImageMagick-libs
1:6.9.12.77-1.amzn2023.0.1, 7.1.0.19-8.ph4, 7.1.1.11-1.ph5
ImageMagick-perl
1:6.9.12.77-1.amzn2023.0.1, 6.9.10.68-3.24.amzn1, 6.9.10.68-6.amzn2.0.1
libMagick++-6_Q16-3
6.8.8.1-71.183.1
libMagick++-7_Q16HDRI4
7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI4-32bit
7.0.7.34-150200.10.42.1
libMagick++-7_Q16HDRI5
7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
libMagick++-7_Q16HDRI5-32bit
7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
libMagick++-devel
6.8.8.1-71.183.1, 7.0.7.34-150000.3.123.1, 7.0.7.34-150200.10.42.1, 7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
libMagick++-devel-32bit
7.1.0.9-150400.6.12.1, 7.1.1.17-1.1
libMagickCore-6_Q16-1
6.8.8.1-71.183.1
Timeline
Publicly disclosed
Feb 6, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-404 Improper Resource Shutdown or Release
References
- advisoryhttps://bugzilla.suse.com/1153866
- advisoryhttps://bugzilla.suse.com/1181836
- advisoryhttps://bugzilla.suse.com/1182325
- advisoryhttps://bugzilla.suse.com/1182335
- advisoryhttps://bugzilla.suse.com/1182336
FAQ
Common Questions.
ImageMagick 7.1.0-49 is vulnerable to Denial of Service.
Affected: ImageMagick versions 7.1.0-49; rootio-imagemagick; ImageMagick-c++-devel (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ImageMagick 7.1.0.52-r0, ImageMagick 8:6.7.7.10-6ubuntu3.13+esm5, ImageMagick 8:6.8.9.9-7ubuntu5.16+esm7.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-44267 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo