CVE-2012-1185
Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 27.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 27.89% probability · 98th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- imagemagick/imagemagick · debian/debian linux · canonical/ubuntu linux · opensuse/opensuse
- Source
- secalert@redhat.com
EPSS moved from 27.9% on 2 October 2026 to 27.9% on 4 November 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/47926Broken Link
- http://secunia.com/advisories/48974Broken Link
- http://secunia.com/advisories/49043Broken Link
- http://secunia.com/advisories/49317Broken Link
- http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.cBroken Link
- http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.cBroken Link
- http://ubuntu.com/usn/usn-1435-1Third Party Advisory
- http://www.debian.org/security/2012/dsa-2462Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/03/19/5Mailing List, Patch, Third Party Advisory
- http://www.osvdb.org/80556Broken Link
- http://www.securityfocus.com/bid/51957Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1185Issue Tracking, Patch, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76140Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/47926Broken Link
- http://secunia.com/advisories/48974Broken Link
- http://secunia.com/advisories/49043Broken Link
- http://secunia.com/advisories/49317Broken Link
- http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.cBroken Link
- http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.cBroken Link
- http://ubuntu.com/usn/usn-1435-1Third Party Advisory
- http://www.debian.org/security/2012/dsa-2462Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/03/19/5Mailing List, Patch, Third Party Advisory
- http://www.osvdb.org/80556Broken Link
- http://www.securityfocus.com/bid/51957Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1185Issue Tracking, Patch, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76140Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.