CVE-2012-0259

medium

Published 2012-06-05 · Modified 2026-04-29

CVSS v3

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2

4.3

VIR risk

6.5

Description

The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2012-0259

vendor Authored 2026-05-27

Vendor advisory: cret@cert.org — https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0259

vendor Authored 2026-05-27

Vendor advisory: cret@cert.org — http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`8:6.7.4.0-4`
debian	bullseye	fixed	`8:6.7.4.0-4`
debian	forky	fixed	`8:6.7.4.0-4`
debian	sid	fixed	`8:6.7.4.0-4`
debian	trixie	fixed	`8:6.7.4.0-4`
suse	11.4	affected
suse	12.1	affected
ubuntu	10.04	affected
ubuntu	11.04	affected
ubuntu	11.10	affected
ubuntu	12.04	affected
debian	6.0	affected

Application impact

Vendor	Product	Versions	Fixed
imagemagick	imagemagick	`{"endExcluding":"6.7.6-3"}`	`6.7.6-3`

References

CWEs

CWE-125

Verify integrity in audit chain (admin only). AS-IS.