EUVD-2026-14780
GHSA-27g8-mxrv-gmvr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
AnalysisAI
Memory corruption through out-of-bounds writes in Android-ImageMagick7 prior to version 7.1.2-11 enables local attackers to achieve arbitrary code execution with user interaction. The vulnerability affects Google's implementation of ImageMagick and carries a CVSS score of 7.8, indicating high severity with complete confidentiality, integrity, and availability impact. A patch is available for affected users.
Technical ContextAI
Android-ImageMagick7 is a port of the popular ImageMagick image processing library for Android platforms, maintained by MolotovCherry. The vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption issue where data is written beyond the allocated buffer boundaries during image processing operations. This class of vulnerability typically occurs when parsing malformed or specially crafted image files without proper bounds checking, leading to buffer overflow conditions. The affected product is identified via CPE as cpe:2.3:a:molotovcherry:android-imagemagick7, indicating this is specific to the Android port rather than the upstream ImageMagick project.
RemediationAI
Upgrade Android-ImageMagick7 to version 7.1.2-11 or later to address this vulnerability, as documented in the vendor patch at https://github.com/MolotovCherry/Android-ImageMagick7/pull/194. Developers should update their dependency declarations to reference the patched version and rebuild affected Android applications. Until patching is completed, implement defensive measures including strict input validation on all image files, sandboxing image processing operations with minimal privileges, and avoiding automatic processing of images from untrusted sources. Consider implementing file type validation and size restrictions to reduce the attack surface, and educate users about the risks of opening images from unknown sources.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today