CVE-2024-41817 Arbitrary Code Execution in `AppImage` version `ImageMagick`
Attackers can execute arbitrary code by placing malicious files in the current working directory due to unsafe environment variable handling in the AppImage version.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41817?
CVE-2024-41817 is a high-severity code injection vulnerability in Imagemagick Imagemagick, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment variables while executing, which might lead to arbitrary code execution by loading malicious configuration files or shared libraries in the current working directory while executing `ImageMagick`. The vulnerability is fixed in 7.11-36.
Weakness: CWE-427
Which versions are affected by CVE-2024-41817?
It affects 1 product.
Products include Imagemagick Imagemagick.
How do I fix CVE-2024-41817?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-41817 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41817 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Imagemagick Imagemagick
Sources
Also known as GHSA-8rxc-922v-phg8, JLSEC-2026-913.