What is the CVSS score of EUVD-2026-14758?

EUVD-2026-14758 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by EUVD-2026-14758?

Android-ImageMagick7 contains a critical vulnerability (CVSS 8.8) that could allow attackers to execute arbitrary code or corrupt data through malicious image files.. A patch is available.

How to fix or mitigate EUVD-2026-14758?

Within 24 hours: Identify all applications and systems using Android-ImageMagick7 and assess their exposure in production environments. Within 7 days: Apply vendor patch to version 7.1.2-10 or later across all affected Android applications and deploy updates to end users through your app distribution channels. Within 30 days: Verify patch deployment completion, conduct post-patch validation testing, and document remediation in your vulnerability management system.

Android EUVD-2026-14758

| CVE-2026-33854 HIGH

Out-of-bounds Write (CWE-787)

2026-03-24 GovTech CSG

Google Buffer Overflow Memory Corruption Android

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 06:15 euvd

EUVD-2026-14758

Analysis Generated

Mar 24, 2026 - 06:15 vuln.today

Patch released

Mar 24, 2026 - 06:15 nvd

Patch available

CVE Published

Mar 24, 2026 - 05:57 nvd

HIGH 8.8

DescriptionCVE.org

Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-10.

AnalysisAI

Memory corruption through out-of-bounds write in Android-ImageMagick7 before version 7.1.2-10 enables remote code execution when a user processes a malicious image file. An attacker can exploit this vulnerability over the network without authentication to achieve complete system compromise including data theft, modification, and denial of service. A patch is available for affected Android devices running vulnerable versions of the ImageMagick library.

Technical ContextAI

Android-ImageMagick7 is a native Android port of the widely-used ImageMagick image processing library, identified by CPE cpe:2.3:a:molotovcherry:android-imagemagick7. The vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption issue where the application writes data beyond the allocated buffer boundaries during image processing operations. This class of vulnerability typically occurs when processing malformed or specially crafted image files with inadequate input validation or bounds checking, leading to buffer overflow conditions that can overwrite adjacent memory regions. ImageMagick has historically been a target for security research due to its complex parsing of numerous image formats, making proper memory management critical in mobile environments with constrained resources.

RemediationAI

Upgrade Android-ImageMagick7 to version 7.1.2-10 or later, which addresses the out-of-bounds write vulnerability according to the vendor patch available at https://github.com/MolotovCherry/Android-ImageMagick7/pull/184. Application developers using this library should update their dependencies immediately and rebuild affected applications. Until patching is completed, implement defensive measures such as restricting image processing to trusted sources only, implementing strict file type validation and sanitization before processing, running image processing operations in sandboxed environments with minimal privileges, and monitoring for abnormal memory usage or crashes during image operations. Applications that cannot be immediately updated should consider disabling or restricting image upload and processing features from untrusted users.