Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've heard there may be security concerns when using ImageMagick on arbitrary user-provided images. For example, the link below gives evidence that there used to be some buffer overflow exploits. Does anyone know if I can now safely use this as part of a web service dealing with user images?

share|improve this question
up vote 4 down vote accepted

That security advisory is from 2006. All software has bugs, but I wouldn't say that ImageMagick has more than other software. Seriously, if you are implementing a web service, you're probably just as likely to get hacked by someone through Apache than with ImageMagick.

In short, don't worry about it, but do keep all your software up to date.

EDIT: by the way, I helped a client implement a web service that used ImageMagick, and I never heard of one problem with it.

share|improve this answer
ImageMagick is trivial to hack because its codecs were not designed to handle malicious data. See Sandbox ImageMagick properly or don't use it with untrusted data. – Nathanael Jones May 28 at 22:56

Yes there is a security risk - software has bugs and some of them can be used to attack the system it runs on.

But you can minimize the risk:

  1. Create a user account that has a minimum of permissions so that it is just enough for running ImageMagick. Now use only that account for executing ImageMagick

  2. Enable automatical security updates: Linux systems like Ubuntu can be configured to install automatically install security fixes. This decreases the time your system is vulnerable in case a vulnerability will be found. Windows system also has an auto update system but that does not include third party software like ImageMagick.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.