Skip to main content

ImageMagick CVE-2026-33899

| EUVDEUVD-2026-22100 MEDIUM
Heap-based Buffer Overflow (CWE-122)
2026-04-13 https://github.com/ImageMagick/ImageMagick GHSA-cr67-pvmx-2pp2
Buffer Overflow Heap Overflow
5.3
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-exploitable via file upload with no auth or interaction; impact is crash-only with no confidentiality or integrity effect, consistent with a single null-byte write.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 08:01 vuln.today
Analysis Generated
Jul 24, 2026 - 08:01 vuln.today
EUVD ID Assigned
Apr 13, 2026 - 20:15 euvd
EUVD-2026-22100
Patch released
Apr 13, 2026 - 20:15 nvd
Patch available
CVE Published
Apr 13, 2026 - 19:33 nvd
MEDIUM 5.3

DescriptionGitHub Advisory

When Magick parses an XML file it is possible that a single zero byte is written out of the bounds.

AnalysisAI

Heap-based buffer overflow in ImageMagick's XML parser writes a single out-of-bounds null byte when processing XML content with a zero-length buffer, affecting all ImageMagick releases prior to 7.1.2-19 and 6.9.13-44, and all Magick.NET NuGet packages prior to 14.12.0. The flaw in MagickCore/xml-tree.c allows an unauthenticated remote attacker to crash the ImageMagick process by supplying a crafted XML file, resulting in a denial-of-service condition with no confidentiality or integrity impact confirmed by NVD. No public exploit code is identified at time of analysis, and the EPSS score of 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate very low near-term exploitation probability.

Technical ContextAI

The root cause (CWE-122: Heap-based Buffer Overflow) lies in the NewXMLTree() function within MagickCore/xml-tree.c. When the XML input buffer has a length of zero, the expression length-1 evaluates to -1 (or wraps to a maximum unsigned value), causing a null terminator ('\0') to be written one byte before the start of the allocated heap buffer. The upstream fix replaces the bare index arithmetic with MagickMax(length-1,0), clamping the array offset to a minimum of zero and preventing the out-of-bounds write. Affected CPE strings span the core C library (ImageMagick) as well as all Magick.NET NuGet surface-area variants: Q16, Q16-HDRI, and OpenMP builds across x64, x86, and ARM64 targets. Tags from Red Hat and SUSE suggest downstream Linux distribution packages in those ecosystems also carry the vulnerable code.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later (7.x branch) or 6.9.13-44 or later (6.x branch), available at https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19; the specific patch commit is ae679e2fd19ec656bfab9f822ae4cf06bf91604d. For .NET environments, upgrade all Magick.NET NuGet packages to version 14.12.0 or later, available at https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0. Where immediate patching is not feasible, restrict XML and SVG file processing to trusted sources only, and reject or sanitize zero-length or malformed XML inputs before they reach the ImageMagick parser - this compensating control reduces crash risk but does not eliminate the underlying flaw. Running ImageMagick in an isolated container or sandboxed process (e.g., via seccomp, AppArmor, or a dedicated worker pod) limits the availability blast radius of a crash to the processing instance rather than the broader application. Red Hat and SUSE customers should monitor their respective security advisories for downstream patched package availability.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-33899 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy