CVE-2005-0397: Format string vulnerability in the SetImageInfo function in image.c for ImageMagick before 6.0.2.5 may allo...

Security readout for executives and security teams

This is an old ImageMagick flaw where a specially crafted filename could crash image conversion and might allow code execution. The business risk is highest where web applications pass user-supplied upload names into ImageMagick's convert tool. The bundle does not show current active exploitation. Exposure is likely on legacy systems running ImageMagick before 6.0.2.5, especially upload, thumbnailing, or document/image processing workflows that call convert using external filenames. Modern systems are unlikely exposed unless carrying very old packages or embedded copies. Prioritize remediation for internet-facing upload or image-processing services using legacy ImageMagick. For current supported platforms, confirm patched packages rather than treating this as an emergency absent evidence of active exploitation. Mitigation focus: Upgrade ImageMagick to 6.0.2.5 or later where applicable.; Apply fixed packages from the relevant OS vendor advisory.; Inventory applications that call ImageMagick convert on uploaded or external filenames..

Prepared

Jun 29, 2026, 23:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.