EUVD-2026-14760
GHSA-6v5m-2qxj-978m
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Integer Overflow or Wraparound vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
AnalysisAI
Android-ImageMagick7 versions prior to 7.1.2-11 are vulnerable to integer overflow that allows local attackers with user interaction to cause a denial of service condition. The vulnerability requires local access and user interaction to trigger, making it a lower-risk but still exploitable flaw in image processing operations. A patch is available for affected installations.
Technical ContextAI
Android-ImageMagick7 is a port of the ImageMagick image processing library for Android platforms, identified via CPE cpe:2.3:a:molotovcherry:android-imagemagick7. The vulnerability stems from CWE-190 (Integer Overflow or Wraparound), a classic memory safety issue where integer arithmetic operations exceed the maximum value that can be stored in an integer type, causing the value to wrap around to a very small or negative number. This typically occurs in buffer allocation or size calculations within image processing pipelines. ImageMagick's complex image format parsing routines are particularly susceptible to such issues when processing maliciously crafted image headers or metadata.
RemediationAI
Upgrade MolotovCherry Android-ImageMagick7 to version 7.1.2-11 or later. This patch is available via the GitHub pull request at https://github.com/MolotovCherry/Android-ImageMagick7/pull/187. For applications unable to immediately patch, implement input validation by rejecting image files with suspicious headers or oversized dimensions that might trigger integer overflows during processing. Consider sandboxing image processing operations in a separate process or service with restricted resource limits to prevent full application crashes. Validate all image metadata before passing to the ImageMagick library to catch malformed structure early.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today