CVE-2018-15607

In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36 0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.

• CWE-400

• http://www.securityfocus.com/bid/105137Third Party Advisory, VDB Entry
• https://github.com/ImageMagick/ImageMagick/issues/1255Exploit, Third Party Advisory
• https://usn.ubuntu.com/4034-1/
• http://www.securityfocus.com/bid/105137Third Party Advisory, VDB Entry
• https://github.com/ImageMagick/ImageMagick/issues/1255Exploit, Third Party Advisory
• https://usn.ubuntu.com/4034-1/

Published

Aug 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1560IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 …5.4
• CVE-2018-15601apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0…
• CVE-2018-15602Zyxel VMG3312 B10B devices are affected by a persistent XSS …
• CVE-2018-15603An issue was discovered in Victor CMS through 2018-05-10. Th…
• CVE-2018-15605An issue was discovered in phpMyAdmin before 4.8.3. A Cross-…
• CVE-2018-15606An XSS issue was discovered in SalesAgility SuiteCRM 7.x bef…
• CVE-2018-15608Zoho ManageEngine ADManager Plus 6.5.7 allows HTML Injection…
• CVE-2018-15610A vulnerability in the one-X Portal component of Avaya IP Of…7.3
• CVE-2018-15611A vulnerability in the local system administration component…6.3
• CVE-2018-15612A CSRF vulnerability in the Runtime Config component of Avay…8.3
• CVE-2018-15613A cross-site scripting (XSS) vulnerability in the Runtime Co…8.3
• CVE-2018-15614A vulnerability in the one-x Portal component of IP Office c…6.8