Skip to main content

ImageMagick CVE-2026-33905

| EUVDEUVD-2026-22108 MEDIUM
Out-of-bounds Read (CWE-125)
2026-04-13 GitHub_M GHSA-pcvx-ph33-r5vv
Buffer Overflow Information Disclosure Imagemagick
5.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by file-based attack requiring ImageMagick invocation; no privileges needed for CLI tool; UI:R as processing must be triggered; impact is crash-only (A:H, C:N, I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.0 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:57 vuln.today
Analysis Generated
Jul 24, 2026 - 07:57 vuln.today
Patch released
Apr 14, 2026 - 20:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 21:30 euvd
EUVD-2026-22108
CVE Published
Apr 13, 2026 - 21:02 nvd
MEDIUM 5.5

DescriptionGitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample operation has an out of bounds read when an specific offset is set through the sample:offset define that could lead to an out of bounds read. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19.

AnalysisAI

Out-of-bounds read in ImageMagick's -sample resizing operation allows local attackers to crash the process when the sample:offset define is set to a specific value, causing denial of service in versions below 7.1.2-19 and 6.9.13-44. The flaw originates in SampleImage() within MagickCore/resize.c, where a precomputed offset array was used to index into a pixel scanline buffer without adequate bounds enforcement. No public exploit exists and CISA KEV does not list active exploitation; EPSS at 0.01% (2nd percentile) and SSVC exploitation:none confirm this is a low-urgency issue despite its presence in a widely-distributed tool.

Technical ContextAI

ImageMagick's SampleImage() function in MagickCore/resize.c implements the -sample image scaling operation (CWE-125: Out-of-bounds Read). In the vulnerable code path, the function pre-allocated a global array x_offset[] of column offsets incorporating sample:offset, then fetched an entire pixel scanline via GetCacheViewVirtualPixels() starting at column 0, and subsequently indexed into that buffer using x_offset[x] * GetPixelChannels(image) + i. When sample:offset shifted the precomputed offset outside the scanline's valid column range, this index exceeded the bounds of the fetched pixel buffer, producing an out-of-bounds memory read and resulting in a process crash. The fix restructured pixel fetching to retrieve individual pixels at precise (x_offset, y_offset) coordinates per iteration rather than using the precomputed global array, eliminating the dangling index. Affected CPE is cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:* for all versions prior to the fix, and Magick.NET NuGet packages (Q16-AnyCPU, Q16-HDRI-AnyCPU, Q16-HDRI-OpenMP-arm64, Q16-HDRI-arm64) in versions below 14.12.0.

RemediationAI

Upgrade ImageMagick to version 7.1.2-19 or later (https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19) or to 6.9.13-44 or later on the 6.x legacy branch. For .NET applications using Magick.NET, upgrade to 14.12.0 or later (https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0). Ubuntu users should apply the update referenced in USN-8558-1 (https://ubuntu.com/security/notices/USN-8558-1). The upstream fix commit is available at https://github.com/ImageMagick/ImageMagick/commit/cca607366fb38c2dde019a9088b8415ffba3a835. Where patching is not immediately possible, remove the sample:offset define from any ImageMagick processing pipelines that accept untrusted input - this eliminates the code path that triggers the flaw, though it may change output sampling behavior for applications relying on that define.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-33905 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy