CVE-2022-44268: ImageMagick PNG parsing arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh EPSS and a public exploit write-up make exploitation likely, and the flaw yields direct disclosure of arbitrary readable files, though it requires the target to process a crafted image.

What it is

ImageMagick 7.1.0-49 embeds the contents of an arbitrary local file into the output image when it parses a crafted PNG, for example during a resize. The file is read with the privileges of the magick binary, so any file that process can access may be disclosed. This matters because ImageMagick is widely embedded in web upload and thumbnail pipelines, turning a single crafted image into a file disclosure primitive.

Impact

An attacker gains read access to arbitrary files readable by the ImageMagick process, which can expose configuration files, credentials, source code or other sensitive data. The output image returned to the attacker carries the stolen content.

Attack surface

Reached remotely over the network by supplying a crafted PNG to any service that processes images with ImageMagick; no authentication is required, but the victim or service must process the attacker-supplied image (UI:R).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.89855, 99.78th percentile) and a public exploit write-up is referenced, indicating active interest and likely exploitation.

What to do

• Upgrade ImageMagick to a version that fixes the PNG arbitrary file read (7.1.0-50 or later per vendor guidance).
• Patch or update dependent packages and distributions (Debian DSA-5347, Fedora advisories) that bundle ImageMagick.
• Run image processing with least privilege and restrict filesystem access so the magick process cannot read sensitive files.
• Sanitize or re-encode untrusted images before processing, and disable or restrict PNG delegate/profile handling where feasible.

Detection

• Monitor ImageMagick processes for unexpected reads of sensitive paths such as /etc/passwd, /etc/shadow, application config or key files.
• Inspect uploaded and generated PNGs for embedded text or profile chunks containing file contents.
• Alert on image-processing commands or services spawning with unusual file access patterns or reading files outside expected image directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.