What is the CVSS score of CVE-2026-4755?

CVE-2026-4755 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Android are affected by CVE-2026-4755?

A critical vulnerability (CVSS 9.8) in MolotovCherry Android-ImageMagick7 allows remote attackers to completely compromise affected systems without authentication or user interaction.. A patch is available.

How to fix or mitigate CVE-2026-4755?

Within 24 hours: Identify all systems and applications using MolotovCherry Android-ImageMagick7 and assess exposure; establish incident response readiness. Within 7 days: Test and deploy vendor patch version 7.1.2-11 across all affected systems, prioritizing production environments; verify successful patching. Within 30 days: Complete patching of all remaining systems including development and test environments; conduct security audit of affected systems for signs of compromise.

Android CVE-2026-4755

EUVD-2026-14778 CRITICAL

Improper Input Validation (CWE-20)

2026-03-24 GovTech CSG

GHSA-h6cx-fqvj-hw7c

Google Information Disclosure Android

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 06:45 euvd

EUVD-2026-14778

Analysis Generated

Mar 24, 2026 - 06:45 vuln.today

Patch released

Mar 24, 2026 - 06:45 nvd

Patch available

CVE Published

Mar 24, 2026 - 06:04 nvd

CRITICAL 9.8

DescriptionCVE.org

CWE-20 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.

AnalysisAI

A critical input validation vulnerability (CWE-20) exists in MolotovCherry Android-ImageMagick7 before version 7.1.2-11 that allows unauthenticated remote attackers to achieve complete system compromise with high impact to confidentiality, integrity, and availability. The vulnerability was reported by GovTech CSG and has a CVSS score of 9.8, indicating network-accessible exploitation with no privileges or user interaction required. A patch is available from the vendor via GitHub pull request #193.

Technical ContextAI

Android-ImageMagick7 is a port of the ImageMagick image processing library for Android platforms, identified by CPE cpe:2.3:a:molotovcherry:android-imagemagick7. The vulnerability stems from CWE-20 (Improper Input Validation), indicating the software fails to properly validate or sanitize data before processing, which in image processing libraries typically manifests as unsafe handling of malformed image files or image metadata. This class of vulnerability can lead to buffer overflows, arbitrary code execution, or information disclosure when the library processes specially crafted image files. The affected component is used for image manipulation operations on Android devices, making it a critical component in applications that handle user-supplied images.

RemediationAI

Upgrade Android-ImageMagick7 to version 7.1.2-11 or later by applying the patch available at https://github.com/MolotovCherry/Android-ImageMagick7/pull/193. Development teams should update their dependency declarations in build configurations (build.gradle or equivalent) to reference the patched version and rebuild affected applications. Until patching is complete, organizations should implement defense-in-depth measures including restricting image upload functionality to authenticated users only, implementing strict file type validation at the application layer, scanning uploaded images with multiple validation tools before processing, and isolating image processing operations in sandboxed environments with limited network access. For production Android applications, expedited testing and deployment of the updated library is recommended given the critical severity and network attack vector.