Vulnerability record · CVE-2022-44267 · published 6 February 2023
CVE-2022-44267: ImageMagick PNG parsing leaves convert waiting on stdin, causing DoS
Imagemagick · Imagemagick
ImageMagick 7.1.0-49 mishandles resource shutdown when parsing a PNG image, leaving the convert process blocked waiting for stdin input. The flaw is a denial of service that can hang image-processing pipelines, and the record names only version 7.1.0-49 without a full affected-version list.
Description
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Automated analysis
medium priorityAvailability-only DoS with no privilege or confidentiality impact, but a high EPSS score and public exploit reference raise the practical risk.
What it is
ImageMagick 7.1.0-49 mishandles resource shutdown when parsing a PNG image, leaving the convert process blocked waiting for stdin input. The flaw is a denial of service that can hang image-processing pipelines, and the record names only version 7.1.0-49 without a full affected-version list.
Impact
An attacker can stall or hang the convert process, denying image conversion or resizing service to legitimate users. There is no confidentiality or integrity impact per the CVSS vector; only availability is affected.
Attack surface
Reached remotely over the network when a crafted PNG is supplied to ImageMagick for parsing or resizing, with no privileges required but user interaction needed per the CVSS vector. The description does not state whether the image is uploaded, fetched, or otherwise delivered.
Exploitation
Not listed in CISA KEV, but EPSS is high at 0.766 (99.5th percentile), and a third-party advisory reference is tagged Exploit, indicating public exploit detail exists. No ransomware usage is documented.
What to do
- Upgrade ImageMagick to a release after 7.1.0-49; the record does not list fixed versions, so confirm the fix with the vendor or your distribution.
- Apply the Debian DSA-5347 or Fedora package updates if you run those distributions.
- Run convert with a timeout and resource limits so a hung process cannot block the pipeline.
- Isolate image processing from untrusted input, for example in a sandbox or separate worker with bounded concurrency.
Detection
- Monitor convert or ImageMagick processes for long-running or stuck states waiting on stdin.
- Alert on repeated timeouts or failures in image conversion jobs handling PNG input.
- Track process counts and queue depth for image-processing workers to catch availability drops.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-44267 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-44267), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
