Skip to main content

ImageMagick CVE-2026-33900

| EUVDEUVD-2026-22102 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-04-13 https://github.com/ImageMagick/ImageMagick GHSA-v67w-737x-v2c9
Denial Of Service Integer Overflow
5.9
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable via image upload pipelines; AC:H reflects the 32-bit-only trigger requirement; crash-only impact means C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 08:05 vuln.today
Analysis Generated
Jul 24, 2026 - 08:05 vuln.today
EUVD ID Assigned
Apr 13, 2026 - 19:30 euvd
EUVD-2026-22102
Patch released
Apr 13, 2026 - 19:30 nvd
Patch available
CVE Published
Apr 13, 2026 - 19:09 nvd
MEDIUM 5.9

DescriptionGitHub Advisory

In viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write that can result in a crash.

AnalysisAI

Integer truncation/wraparound in the ImageMagick viff encoder on 32-bit builds allows an out-of-bounds heap write that crashes the processing process, constituting a denial-of-service condition. Affected products span ImageMagick below versions 6.9.13-44 and 7.1.2-19, and the Magick.NET .NET wrapper below 14.12.0. No public exploit exists and CISA KEV does not list this vulnerability; EPSS at 0.04% (12th percentile) and SSVC exploitation status of 'none' confirm low current exploitation urgency despite the network-reachable attack vector.

Technical ContextAI

ImageMagick is a widely-deployed open-source image manipulation suite consumed directly and via the Magick.NET wrapper (nuget packages including Q8/Q16/Q16-HDRI in AnyCPU and x86 variants). The VIFF (Versatile Image File Format) encoder in coders/viff.c computes a packets count as a MagickSizeType - a 64-bit unsigned integer on 64-bit builds, but subject to truncation on 32-bit builds. The root cause is CWE-190 (Integer Overflow or Wraparound): when the calculated packet count exceeds the 32-bit addressable range, truncation yields a smaller value used to size a heap allocation, resulting in an undersized buffer. A subsequent write beyond the buffer boundary constitutes an out-of-bounds heap write. The upstream patch (commit d27b840a61b322419a66d0d192ff56d52498148d) inserts a safety check - if packets != (MagickSizeType)((size_t) packets) - that throws a ResourceLimitError before the undersized allocation proceeds, preventing the overflow on 32-bit targets.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later (https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19) or to 6.9.13-44 or later for the 6.x branch. Magick.NET users should upgrade all affected nuget packages to version 14.12.0 or later (https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0). Ubuntu users should apply the security update referenced in USN-8558-1 (https://ubuntu.com/security/notices/USN-8558-1). If immediate patching is not feasible, migrating any 32-bit ImageMagick deployments to 64-bit binaries eliminates the integer truncation condition entirely and is the most effective compensating control. Alternatively, the VIFF coder can be disabled in ImageMagick's policy.xml with the directive '<policy domain="coder" rights="none" pattern="VIFF"/>', preventing the vulnerable encoder from being invoked at the cost of losing VIFF format support. WAF or application-layer filtering to reject VIFF format uploads is an additional layer of defense.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-33900 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy